Security Researcher Exposes: Buying Relay Station Data Allows 'Takeover' of 7 Government Agencies and 19 Major Chinese Companies

Security Researcher Exposes: Buying Relay Station Data Allows "Takeover" of 7 Government Agencies and 19 Major Chinese Companies

Security researcher Chaofan Shou recently claimed on social media platform X that he paid to purchase approximately 6TB of data from a leading domestic large model "relay station." This data is mixed with a large number of SSH keys, VPN configurations, Alibaba Cloud credentials, and GitLab tokens that users forwarded through the relay station while using AI coding tools.

He stated that with this batch of data alone, it is enough to gain access to the relevant system permissions of 7 government agencies in China and CIS countries, as well as 19 well-known enterprises including Xiaomi, Huawei, NIO, and MiniMax. A screenshot he posted shows a table listing code hosting addresses of institutions such as Sangfor, NIO, Bilibili, Xiaomi, University of Science and Technology of China, and Zhejiang Lab, with the corresponding token information redacted.

Chaofan Shou is also the person who previously exposed the Claude Code source code leak incident.

What Is a "Relay Station"

Many domestic developers, in order to save money and for convenience, call APIs of large models such as Claude and GPT through third-party "relay stations" rather than connecting directly to official channels. A relay station acts as a proxy, helping users forward requests and unify billing.

The problem is that the relay station, as an intermediary layer, can see the full plaintext content of every request and response. If users are using coding AI tools that can operate terminals and read/write files (such as writing code and running commands), then keys, passwords, and configuration information appearing in the session will pass through the relay station's servers as-is—this is also why what leaked this time are all sensitive information such as SSH keys and cloud credentials.

Not an Isolated Case

A research paper co-authored by Chaofan Shou tested 28 paid relay stations and 400 free relay stations, finding that 1 paid and 8 free relay stations were actively tampering with the operation instructions returned by AI, 2 had deployed mechanisms to evade detection, 17 had "incidentally" come into contact with test credentials planted by the researchers, and 1 directly emptied the researchers' cryptocurrency test wallet. The paper estimates that with this method, approximately 400 hosts can be compromised within a few hours.

The paper also mentions this year's March LiteLLM supply chain attack incident—where hackers injected malicious code into a large number of deployments by contaminating dependency packages—proving that such attacks have already occurred in reality.

How Enterprises Should Defend

For enterprises, the risk is often not that the company actively chooses to use relay stations, but that employees, for convenience, connect relay stations to internal coding tools without the company's knowledge. Actions that can be taken include:

• Restrict access to known relay station domains at the firewall and proxy levels, making "which model service to use" a matter requiring approval, rather than something employees can use by configuring a Key themselves;

• Uniformly issue keys that go through official or enterprise-built gateways for coding AI tools, prohibiting employees from bringing their own relay station accounts to connect to company devices;

• Use short-term tokens and on-demand temporary credentials for internal systems as much as possible, reducing the window period caused by a single leak;

• Set up a separate set of accounts with limited permissions for AI coding sessions, isolated from accounts that can access production environments and core code repositories;

• Investigate historically whether keys or tokens have appeared in AI tool sessions; once discovered to have gone through unofficial channels, directly treat them as "already leaked" and rotate all of them;

• Prohibitions alone are useless; employees bypassing official channels is usually just to save money and effort, so enterprises must make the cost and experience of official channels no worse than relay stations.

The several institutions exposed this time all have formal security teams themselves. This shows that "the company has a security department" and "the company's developers are not using relay stations" are two completely different things.