Researchers have discovered a sophisticated infrastructure operation that enables Chinese users to access American frontier AI models while concealing their identities and locations. The operation leverages more than 80,000 relay servers distributed across the internet, creating an anonymization layer that masks traffic originating from China.
The relay network operates as a proxy infrastructure, routing requests through intermediate servers before they reach target AI services hosted in the United States. This architecture serves a dual purpose: it obscures the geographic origin of API calls and circumvents access restrictions that many US AI companies implement to comply with export controls and sanctions regimes.
Security researchers believe the relay infrastructure targets advanced large language models from major US AI providers. The volume and persistence of traffic patterns suggest the activity aims at model cloning or capability extraction. In this attack scenario, threat actors make repeated API calls to reverse-engineer proprietary model architectures, training data characteristics, and behavioral outputs. Once extracted, this information enables creation of functionally equivalent models without the original development investment.
The scale of this operation underscores tensions between US AI dominance and Chinese technological advancement. Frontier AI models represent enormous competitive advantages. Access to these systems allows potential competitors to accelerate their own model development timelines and reduce research costs. US export control policies explicitly restrict foreign access to advanced AI capabilities, but enforcement mechanisms remain limited when requests are anonymized through relay networks.
The relay infrastructure itself uses legitimate cloud hosting providers and residential IP networks. This creates attribution challenges for defenders. Individual relay nodes handle only fragments of user sessions, making it difficult to identify orchestration patterns or command-and-control servers. The distributed nature of the network provides resilience against takedown attempts.
No specific threat actor attribution has been publicly confirmed, though the scale and sophistication suggest state-level involvement or coordination. Chinese government agencies have demonstrated prior interest in acquiring advanced technology through both commercial and covert channels. The AI relay operation aligns with known Chinese strategies for technology acquisition and represents a natural extension of those efforts into the frontier AI domain.
US AI companies and government agencies face enforcement challenges. Blocking traffic based solely on anonymization cannot be implemented without severe collateral damage to legitimate users employing VPNs and proxy services. Effective countermeasures require behavioral analysis and rate-limiting policies that identify systematic model extraction attempts regardless of traffic origin.
This activity reflects broader geopolitical competition over AI capabilities and the inadequacy of current export control mechanisms against sophisticated adversaries. As frontier AI models become increasingly valuable assets, the pressure to access them through covert channels will likely increase. Organizations hosting these models must implement detection systems that identify model cloning attempts and anomalous access patterns rather than relying solely on geographic restrictions.
The discovery reinforces the need for enhanced API monitoring, stricter authentication requirements, and international coordination on AI security standards. Companies providing cutting-edge AI access must balance accessibility with security, a challenge that current infrastructure designs do not adequately address.