Anthropic goes to great lengths to prevent people in China from using its AI models, but in practice, its safeguards have often failed. Over the past year, startups, researchers, and tech enthusiasts across the country have developed increasingly sophisticated workarounds to access Claude. Many of them consider it the world’s most capable AI assistant, making the extra effort to obtain it worthwhile.

Anthropic goes to great lengths to prevent people in China from using its AI models, but in practice, its safeguards have often failed. Over the past year, startups, researchers, and tech enthusiasts across the country have developed increasingly sophisticated workarounds to access Claude. Many of them consider it the world’s most capable AI assistant, making the extra effort to obtain it worthwhile.

In early June, Anthropic publicly released Fable 5, a safeguarded version of its most powerful AI model to date, Mythos. Chinese social media immediately lit up with posts from people sharing their impressions after trying it out. (Anthropic revoked access to the model worldwide a few days later in response to export controls imposed by the Trump administration).

Chinese people generally can access other Western AI tools, such as OpenAI’s ChatGPT, by using virtual private networks, foreign phone numbers, and international payment methods to create and maintain their accounts. But Anthropic has arguably taken more aggressive steps, such as banning accounts that it suspects are owned and controlled by people located in China. On Chinese social media, users frequently report that they have been suspended from Claude without warning, despite taking those precautions.

The cat-and-mouse game has fueled a thriving underground economy for Claude access in China. Accounts are sold on Chinese ecommerce platforms like Taobao and through illicit marketplaces on Telegram. More recently, a cottage industry of “transfer stations” has also emerged. These services act as intermediaries, purchasing access to Anthropic’s API outside China and then redistributing Claude API tokens to users inside the country. The set up is designed to give startups and other professional users more stable and reliable access to AI assistant.

Michael Aciman, a spokesperson for Anthropic, says that the company uses a range of evolving detection systems, including identity verification, to enforce its policies against unauthorized access to Claude. He added that Anthropic has also worked to detect and disrupt proxy networks used to provide access to the chatbot in China.

Despite all of the difficulties Chinese people are forced to overcome to use Claude, there remain many loyal fans of Anthropic in the country. It’s especially popular among programmers. Even though Chinese companies like DeepSeek and Z.ai have some of the most capable open-source large language models on the market, third-party tests still show that they lag behind leading closed models like Claude. During a recent reporting trip to China, WIRED spoke to academics and engineers at multiple tech companies who said that they preferred using Claude over Chinese models to generate code, and are eager to try out each new model that Anthropic releases.

Zilan Qian, a research associate at the Oxford China Policy Lab, looked into the black market for reselling Western AI tokens to Chinese users. He noted that Chinese software developers say they overwhelmingly prefer using tools like Claude Code and OpenAI’s Codex compared to tools from domestic companies. “Analysis shows that Chinese models are still six to nine months behind the US models, and for specific things like coding and developing, you can obviously tell the gap,” Qian says.

“For both Chinese AI policymakers and technical people, they have much less of a problem drawing on and using American ideas or products, regardless of the geopolitical or ideological rivalry,” says Matt Sheehan, a senior fellow at the Carnegie Endowment for International Peace, where he researches AI policy and China. “It’s Americans who tend to think an idea or a product is tainted just because it comes from their rival,” he says.

Dario Amodei, Anthropic’s cofounder and CEO, often explicitly singles out Chinese access to frontier models as a critical threat to US national security. Just this week, Anthropic accused Alibaba of using Claude outputs to train the Chinese company’s rival models, a technique known as “distillation.” Anthropic has also claimed other Chinese companies have done the same thing in the past. For this and other national security reasons, Anthropic does not offer commercial access to Claude in China, or to subsidiaries of Chinese companies located outside of the country.

Still, people continue to find workarounds. For casual users, that might mean sticking to classic tactics like turning on a VPN and using a consistent proxy location, creating the illusion that they are always connecting to Claude from the same place instead of bouncing around the world. Less technical users can go on Chinese ecommerce platforms like Taobao and Xianyu to buy Claude accounts that have already been set up. Anthropic often still bans them after a while, but for people who only want to briefly test Claude or ask occasional questions, the loss is manageable.

Similar marketplaces have popped up on Telegram over the last few years, says Hieu Minh Ngo, a reformed criminal hacker turned cybercrime investigator at the Vietnamese scam-fighting nonprofit ChongLuaDao. On websites and Telegram channels Ngo and other researchers shared with WIRED, users market what they claim to be Claude Pro and Claude Max accounts, alongside others for ChatGPT Plus and Gemini Plus. These underground Chinese-language marketplaces particularly focus on selling “pro” accounts, which allow greater numbers of prompts to be sent, Ngo says.

The frenzy over OpenClaw in China earlier this year also fueled demand for AI agents, Qian says. Because these tools perform more complex tasks, they consume far more tokens than a typical chatbot session. For heavy users, especially developers who need a constant stream of prompts and responses, finding affordable, reliable access to tools like Claude and Codex quickly became a necessity.

That’s when transfer stations, also called relay stations, came in. Set up with servers in an Anthropic-supported country, they work as middlemen between Chinese users and Anthropic. Instead of logging into Claude directly, a user sends prompts to a locally-accessible website, which forwards the request to Claude through individual accounts or API keys. The response from the model is then passed back to the user. To the user, it can feel the same as chatting with Claude, just on a different platform. To make it more appealing to heavy users, transfer stations often charge a cheaper price than Claude’s own API access since they can get enterprise discounts from Anthropic and other licensed distributors.

Today, the demand has spurred Chinese-language websites and GitHub pages listing dozens of transfer stations and comparing a variety of models and token prices. Even the infamous Chinese crypto billionaire Justin Sun joined the game and opened his own transfer station in May.

The sheer number of Chinese users accessing Anthropic through proxy connections may have distorted the picture of who’s using Claude worldwide. Singapore, with its prominence in international business and dominant use of the Chinese language, often becomes the prime target for Chinese users to fake their geographic locations or route through transfer station traffic. Anthropic’s published data says that Singapore, a country of merely 6 million people, is often among the top countries in the world by Claude adoption relative to population size (the United States still uses Claude far more than any other country, according to the data).

Anthropic has continued tightening its restrictions to keep people in China and other restricted countries out. In April, the company rolled out identity verification for some Claude users. The process is handled by Persona, a third-party company backed by the venture capital fund Founders Fund, which requires users to upload a government-issued photo ID, such as a passport, driver’s license, or national identity card before they can log into Claude. IDs from unsupported countries won’t count. And if an account fails to pass the verification test, it could be banned.

The requirement, which some Chinese users have compared to the Know Your Customer (KYC) identity verification required by financial institutions, shifted the workaround market away from Claude accounts and APIs and toward fake identities. Over the past couple of months, Ngo says he has seen Chinese-language Telegram channels begin advertising Claude accounts that have already passed the identification checks. “They are talking about how to bypass KYC, where to buy the Claude KYC so they can use it,” Ngo says.

Perhaps it’s time to acknowledge that, no matter how strictly Anthropic enforces its geographical restrictions, as long as models are still released to the general public, savvy users in China and other unsupported countries will likely continue to find ways to keep using Claude. And the black markets are always ready to provide non-technical users with turnkey solutions.

But the unfortunate result is that by accessing Claude through more and more unsanctioned tools, users are also exposing themselves to more security risks. Not only can they be scammed by sellers on Telegram, the sensitive information and prompts they send through transfer stations could end up being packaged and sold by the intermediary company to unscrupulous buyers. All of these added wrinkles will pose new challenges for AI safety. “People who are working on AI safety need to think, if this transfer station infrastructure remains, how are you going to monitor bad actors and prevent them from doing bad things?” Qian says.

Additional reporting by Will Knight.

This is an edition of Zeyi Yang and Louise Matsakis’ Made in China newsletter. Read previous newsletters here.