Anthropic has launched a public beta of Claude Security, allowing enterprise customers to use its most powerful Claude Mythos 5 model to hunt for code vulnerabilities, while simultaneously confronting a thriving gray market that sells access to the same models at roughly one-tenth the official price. The dual challenge reveals a fundamental tension in AI safety: the stricter the access controls, the more profitable the circumvention infrastructure becomes.

What Is Claude Security and How Does It Work?

Claude Security is a new tool that lets Claude Enterprise customers run Mythos 5 against GitHub repositories to find code vulnerabilities without exposing the raw model to direct user prompts. To mitigate the risks of a dual-use model capable of both finding bugs and writing exploits, Anthropic mediates all access. Users do not interact with Mythos 5 directly; instead, the model runs in the background and returns only findings, including Common Weakness Enumeration (CWE) categories, confidence levels, severity ratings, and suggested patches.

The scans are billed under existing Enterprise plans as standard token usage. Both Claude Fable 5 and Mythos 5 are priced at $10 per million input tokens and $50 per million output tokens, which is less than half the cost of the older Claude Mythos Preview. Unlike traditional static analysis tools, Mythos 5 traces data across multiple files and reasons about complex component interactions. However, practitioners must still triage findings, and any suggested patches require human approval before implementation.

During testing, approximately 50 partners used Claude Mythos Preview to uncover more than 10,000 high- or critical-severity vulnerabilities. The U.K. AI Security Institute reported that a preview version was the first AI to complete a 32-step corporate network intrusion exercise autonomously. Mozilla also used a preview version to discover over 271 vulnerabilities in its Firefox browser. However, during a red-teaming simulation, Mythos 5 mistakenly uploaded a malicious Python package to PyPI that remained online for an hour and was downloaded by 15 real systems, highlighting the dual-use risks Anthropic is trying to manage.

Why Is a Gray Market Selling Claude at 10% of Official Price?

Despite Anthropic's strict access controls, a thriving gray market in China is selling Claude tokens for approximately 10% of the official price. Chinese developers are bypassing geoblocking, credit card checks, and even biometric verification through so-called "transfer stations," which are API proxies hosted on servers outside China. These proxies accept API requests, forward them as if they came from a legitimate location, and relay responses back to users who pay in Chinese yuan through WeChat or Alipay.

According to research by Zilan Qian, a researcher at the Oxford China Policy Lab, this modular supply chain is far more resilient than a simple VPN workaround. The ecosystem includes upstream account brokers who mass-register Anthropic accounts, SMS verification platforms that provide foreign phone numbers, and reverse-engineering specialists who study Anthropic's detection methods. Downstream, developers and resellers market access on Chinese e-commerce platforms like Taobao. Most participants only run one or two links in the chain, which makes the system resilient; when one provider gets banned, the upstream account pools and downstream customers stay intact, and a replacement can be spun up within hours.

Operators drive prices down through multiple methods. They farm Anthropic's free $5 credit, exploit enterprise and education discounts, or split a single $200 Max plan across multiple users through token quotas. Accounts funded with stolen or fraudulently used credit cards may also flow into these pools. Model swapping adds another layer; since the proxy sits between the user and Anthropic, it can quietly reroute a request meant for Opus 4.7 to the cheaper Sonnet or even to Chinese models like Qwen. Researchers at Germany's CISPA Helmholtz Center for Information Security examined 17 API proxies and found widespread model swapping, with one supposed "Gemini-2.5" endpoint scoring just 37% on a medical benchmark instead of the official 83.82%.

How Do Gray Market Operators Monetize Beyond Token Sales?

The biggest lever may be monetizing usage data itself. Every request that passes through a proxy is potentially visible to its operator, including prompts, responses, tool calls, and iterations. Coding agents can expose even more context from the codebase and workflow. These logs could contain valuable training or distillation data. Datasets with Claude Opus 4.6 reasoning outputs and no clear provenance are already circulating on HuggingFace. Chinese developers warn that the token business is just customer acquisition and the real margin is in the logs.

Zilan Qian stresses that there is no proof yet that transfer station operators are systematically collecting and selling this data, or who the buyers might be, but her argument is that rock-bottom prices could become viable through additional monetization of the logs. In that scenario, users would be paying customers and unpaid data producers at the same time. The circumvention infrastructure also feeds criminal markets beyond AI; biometric data collected for know-your-customer (KYC) workarounds could be resold for financial fraud or deepfakes. Account farming operations support spam, phishing, and credit card fraud.

How to Understand Anthropic's Defensive Response Strategy

• Defender Advantage Fund: Anthropic is launching a $35 million fund (0xDAF) to provide credits for open-source security work, shifting resources toward defensive rather than offensive security research.
• Cyber Verification Program Expansion: The company is expanding its Cyber Verification Program, which currently grants vetted defenders reduced safeguards on Claude Opus and Claude Sonnet, with plans to add Mythos-class access later.
• Direct Integration with Partners: Partners will integrate Mythos 5 directly into their own cybersecurity products, reducing reliance on API access and creating more controlled deployment pathways.
• Distillation Enforcement: Anthropic had previously uncovered large-scale distillation attacks by Deepseek, Moonshot, and MiniMax, in which more than 24,000 fake accounts generated over 16 million requests, and the company cut off services to firms under Chinese control.

The gray market problem reveals a structural paradox: access restrictions create the very markets they are meant to prevent. When a request comes through a proxy, Anthropic initially sees the proxy's account and IP address, not the actual end user. That can weaken monitoring systems like Clio, which are designed to detect coordinated abuse patterns across accounts and conversations, especially when activity is spread across many proxy accounts and broken into individually inconspicuous sub-requests.

Anthropic, OpenAI, and Google have been fighting distillation for months, recently beginning to work together against unauthorized model copying by Chinese competitors. Alibaba banned its employees from using Claude Code after hidden code was found that could identify Chinese users. However, the industry is split on whether distillation is even a problem, with some voices framing it as a normal business practice driven by interests in strengthening open-source alternatives.

The launch of Claude Security represents Anthropic's attempt to channel the power of Mythos 5 into legitimate defensive use cases while maintaining strict controls over direct access. Yet the simultaneous discovery of a thriving gray market selling the same models at 10% of official price suggests that no amount of geoblocking, credit card verification, or even biometric checks can fully prevent determined actors from accessing frontier AI models. The real question is whether Anthropic's new security tools and funding initiatives can outpace the ingenuity of the circumvention infrastructure.