This is something I heard already during my last trip to China. Lately videos appeared making a claim that sounded ridiculous even by AI-video standards: Chinese students were apparently accessing Claude and other frontier models for 2% of the official API price. Because I already had some info on the topic, I knew this time it was real but I my info were contradictory on the mechanism. Let's look at it together.
And nom this is not about a 20% student discount. Something closer to paying two or three cents for a dollar of frontier AI.
I assumed there was a catch. There is. Quite a large one. But the market itself is real.
In China there is a well-established ecosystem of services called 中转站, zhongzhuanzhan, literally “transfer stations”. They sit between a user and model providers such as Anthropic. Instead of buying Claude directly from Anthropic, you buy access from the intermediary, normally paying locally in RMB. The intermediary handles whatever happens upstream.
ChinaTalk investigated the market earlier this year and found something considerably more developed than students exchanging passwords in a WeChat group. There are account suppliers, resellers, verification services, proxy operators and developers, with different businesses occupying different parts of the chain. Users range from students and hobbyists to professors, developers and companies.
And yes, the prices can be extraordinary.
Claude Opus 5 currently costs $5 per million input tokens and $25 per million output tokens through Anthropic. Yet Chinese price trackers currently show unofficial Opus 5 routes at a few percent of that price. One tracker lists a route at 0.01 times the official input price, while explicitly warning that very cheap channels often rely on Kiro, reverse-engineered access or similar routes where stability and even the model version may be uncertain. Another tracker recently showed Opus 5 offers around 0.03 times official pricing.
That distinction is important.
It does not mean Anthropic can deliver Opus profitably for 3% of its current price and is simply enjoying a 3,000% margin.
It means somebody has found another way of obtaining, repackaging, subsidising, sharing, imitating or.. occasionally stealing the underlying resource.
And that, for me, is where the story becomes interesting.
This is less a story about cheap Claude than a story about what people do when you put a valuable technology behind enough barriers.
What does buying grey-market Claude actually look like?
Before getting into the geopolitics, it is worth making this very concrete. Imagine I am a Chinese university student. I want to use Opus 5 for coding. Perhaps I have tried local models and I prefer Claude for a particular task. Perhaps I want Claude Code. Perhaps everyone in my developer group is talking about it.
Getting an official Anthropic account is not straightforward. China is outside Anthropic’s supported market and the company has progressively tightened its access controls. ChinaTalk documents the layers that have appeared over time: geographic restrictions, foreign telephone numbers, overseas payment methods and, in some cases, identity verification.
So I go where Chinese developers already go.
I find a transfer station.
When I looked into this is how boring the experience can be. There is no dark-web interface with skulls in the header. A transfer station can look like any other developer service. You create an account, put some RMB into a prepaid balance, generate an API key and see a catalogue of models and prices.
Payment can happen through familiar domestic mechanisms such as Alipay or WeChat Pay. Then comes the part that makes the whole ecosystem possible.
Normally, software configured for Anthropic sends its request to Anthropic. With a transfer station, the user changes the destination so the request goes to the intermediary instead. The intermediary provides an API endpoint designed to behave enough like the original service that existing software can often continue working with very little modification.
So from the student’s perspective the route changes from:
Laptop → Anthropic → Opus
to something closer to:
Laptop → transfer station → upstream source → Opus → transfer station → laptop
The student may have no idea what that “upstream source” actually is. That is the crucial point.
Perhaps the transfer station has genuine API access obtained through a legitimate commercial arrangement. Perhaps it is consuming discounted capacity. Perhaps it is pooling subscriptions. Perhaps it has reverse-engineered access offered through another AI product. Perhaps it is cycling through accounts. Perhaps the request is not going to Opus at all.
The user sees a dropdown saying “Claude Opus 5” and a price.
That is enough for a market to exist.
This also explains why saying “Chinese students get Claude at 2% of the price” is simultaneously true enough to be interesting and misleading enough to require explanation.
They are not receiving a secret Anthropic student tariff.
They are buying from a secondary market.
How can anyone sell $1 of intelligence for three cents?
This was the question that sent me down the rabbit hole. Part of the answer is surprisingly ordinary: arbitrage.
The same AI capability is now sold under completely different commercial models. Anthropic sells tokens through an API. Another company may buy those models and bundle them into a coding subscription. A large enterprise may negotiate different economics. A startup gets credits. A university programme gets access. Cloud providers package models into their own services.
Kiro is a good illustration. Amazon launched a student tier this year giving eligible students 1,000 credits a month for a year at no cost. The current programme started with 11 universities in the US and Canada, so this is not evidence of some official China-specific loophole. What it illustrates is that the same underlying AI resource can have a very different economic value depending on the package around it.
This happens everywhere.
A gym can offer unlimited access for €40 because it knows most customers will not work out eight hours a day. A mobile operator can sell 100GB for a fixed price because average consumption is much lower. Airlines sell the same seat at five different prices.
AI subscriptions work on similar assumptions.
If a $100 or $200 subscription gives a heavy user access to an amount of inference that would cost far more when purchased token by token through an API, there is an arbitrage opportunity. Pool enough subscriptions, distribute requests intelligently across them and suddenly your effective token cost looks very different.
ChinaTalk describes versions of exactly this, including unused quota resale, educational or corporate discounts and what Chinese developers call “APImaxxing”: carving fixed-price subscriptions across many users.
There are also less innocent sources. Anthropic reported this year that it had identified approximately 24,000 fraudulent accounts involved in more than 16 million exchanges with Claude in campaigns it attributed to DeepSeek, Moonshot AI and MiniMax. One proxy network alone allegedly managed more than 20,000 fraudulent accounts. Anthropic says the purpose included distilling Claude’s capabilities in areas such as reasoning, coding and tool use.
At that scale we are no longer talking about someone making clever use of a family subscription. We are talking about infrastructure.
There is another way to improve the economics: simply don’t deliver what the customer bought.
Because the proxy sits in the middle, the user cannot easily prove that a request labelled “Opus” actually reached Opus. ChinaTalk cites research auditing grey-market proxies where model substitution produced dramatically different benchmark performance from the official model.
A service could send the easy requests to a cheaper model and reserve real Opus for the difficult ones. Or route everything to Sonnet. Or to a Chinese model. If the user cannot tell consistently, the margin can be enormous.
It is the AI equivalent of selling extra-virgin olive oil and quietly adding something cheaper to the bottle.
Apparently there is even an appropriate Chinese expression for it: 掺水, adding water, or watering something down.
Then there is the possibility that the tokens are not the most valuable thing being traded.
Every prompt passing through a transfer station also produces data. Code, questions, answers, reasoning traces, user behaviour. ChinaTalk reports claims from Chinese developers that logs can themselves become valuable inputs for model training, data brokerage or other downstream uses. How widespread that practice is cannot be established from the outside, so I would be careful about saying every cheap API is secretly a data-harvesting operation.
But there is a simple rule that applies far beyond China:
If someone is selling something to you at 97% below the normal price, it is worth understanding exactly what else is part of the transaction.
This is where the story connects with the chip war
Zoom out and the pattern becomes more interesting.
For several years, the United States has tried to limit China’s access to the most advanced AI computing hardware. The policy has changed repeatedly and, as of August 2026, some H200 shipments have begun under restrictions, while newer Nvidia systems remain unavailable to Chinese customers. The picture is more complicated than “China cannot buy Nvidia chips”, but access to the leading edge has clearly been constrained.
The first-order logic is obvious.
Frontier AI needs enormous amounts of compute. Make advanced compute harder or more expensive to obtain and you make frontier AI development harder.
That part should not be dismissed. Export controls have costs. Scarcity is real. Building a domestic semiconductor ecosystem is vastly harder than ordering GPUs from Nvidia. But then comes the second-order effect.
People adapt.
If I cannot assume unlimited access to the best chips, efficiency becomes strategically more valuable. I have stronger incentives to extract more capability from less compute. Domestic accelerators receive more investment. Alternative architectures become more interesting. Quantisation, sparsity, mixture-of-experts approaches and better training efficiency become more valuable.
If the best foreign models are difficult to access directly, learning from their outputs becomes more valuable.
If those models become difficult to query from China, proxies become valuable.
If providers block proxies, large pools of accounts become valuable.
If accounts require identity verification, verified identities become valuable.
If API access is expensive, subscription arbitrage becomes valuable.
A restriction does not only remove something from the system. It also changes the reward for finding an alternative.
This is where I think discussions about technology controls often become too linear.
We model the constraint but underestimate the response.
Take away A, therefore B becomes harder.
Probably.
But what new behaviour does making B harder incentivise?
That is the more complicated question.
DeepSeek was already a warning about this
This is also why I think the broader Chinese AI story deserves more nuance than either of the two popular versions.
One version says export restrictions will prevent China from catching up because frontier AI ultimately comes down to compute.
The opposite version says restrictions are useless because China will simply innovate around them.
Both are too neat.
Constraints can absolutely hurt while simultaneously creating pressure to innovate differently.
DeepSeek made that visible.
Whether every claim made around its compute efficiency was initially interpreted correctly is almost beside the point. The broader signal was clear: when compute is more constrained and expensive, there is enormous value in finding ways to achieve more with what you have.
Distillation is another example.
If someone else has spent billions training an extremely capable model, there is an obvious incentive to learn from that model rather than reproducing every step independently. Distillation is standard machine learning. The controversial part is how the teacher’s outputs are acquired and whether doing so violates the provider’s terms.
Anthropic’s allegations suggest this has already become industrial rather than theoretical.
Then comes the grey market, solving a slightly different problem.
Forget training the next frontier model. I am simply a Chinese developer who wants access to today’s frontier model.
The direct route is difficult. So an industry appears to make the indirect route easy. That progression fascinates me because it feels very human. Block the chips and people invest harder in alternatives. Make compute scarce and people optimise. Build the strongest model and others try to learn from it. Restrict access to the model and somebody builds a marketplace to sell access anyway.
Every obstacle creates a new prize for whoever figures out how to get around it.
The second lesson is about the price of intelligence
There is another reason I think this grey market deserves attention, particularly if you are building an AI company. What is the price of Claude Opus 5?
The obvious answer today is $5 per million input tokens and $25 per million output tokens.
But that is Anthropic’s retail API price.
It is not necessarily the economic cost of producing those tokens. It is not necessarily the price paid by a hyperscaler. It is not the effective price inside a subscription. It is not the price after caching. It is not the price inside a negotiated enterprise contract. And apparently it is very far from the price in China’s secondary market.
We are starting to see something analogous to other mature commodities.
There is a list price, a contract price, a bundled price and now, apparently, a street price.
That doesn’t mean the three-cent Opus token is sustainable. It may be based on subsidies, abuse, stolen accounts, model substitution or a business that disappears next month.
But it should make us careful about building companies whose supposed moat is inexpensive access to one frontier model.
Raw intelligence is likely to become cheaper.
Models will keep leapfrogging each other. Open models will close parts of the capability gap. Smaller models will improve. Inference optimisation will continue. Cloud providers will negotiate different economics. Bundles will distort the relationship between API price and effective consumption.
If your product’s advantage is essentially “we call the smartest model”, somebody else will eventually call something equally smart for less.
The durable value has to be somewhere higher in the stack: the workflow you understand, the context you have accumulated, integration into the organisation, evaluation, trust, proprietary data, distribution, user experience and knowing when the AI should not be trusted.
The model is important.
The API key is not a moat.
Fascinating market, terrible place for sensitive data
None of this means I would recommend using a grey-market Claude API for serious company work. Quite the opposite.
Think again about that Chinese student. He puts 50 RMB into an account, gets an API key and starts coding with Opus for almost nothing.
For a personal experiment, perhaps he decides that the risk is worth it.
Now replace the student with a company. The prompt contains proprietary source code. Or customer information. Or financial data. Or employee feedback.
Every one of those requests is passing through an intermediary whose ownership, infrastructure, retention practices and upstream model access may be unclear.
You may not even be able to establish with certainty which model processed the request.
Saving 95% on tokens under those conditions is not procurement brilliance.
It is misunderstanding what you are buying.
This is an important distinction because ingenuity should not automatically be romanticised. Some of what this ecosystem does is clever engineering and perfectly recognisable market arbitrage. Some of it occupies a genuine grey area. Some of the behaviour documented by Anthropic is straightforward account fraud and deliberate circumvention.
Those things are not morally equivalent simply because they all produce cheap tokens.
But they are economically connected by the same force: demand that has not disappeared just because the official route became difficult.
Every wall creates a market for ladders
That is probably what I will remember from this story.
We spend a lot of time discussing AI geopolitics from the top down: governments, export controls, trillion-dollar semiconductor investments, national champions, model regulation.
Then you look at the other end of the system and find a student putting 30 RMB into a website, changing an API endpoint and using one of the world’s most advanced models that afternoon.
Between Washington’s export-control policy and that student sits an entire improvised supply chain.
Somebody supplies accounts. Somebody provides payments. Somebody operates infrastructure. Somebody figures out authentication. Somebody balances requests across capacity. Somebody compares prices. Somebody sells access. Someone else checks whether the “Opus” being sold is actually Opus.
People’s ingenuity always finds a way sounds like a cliché until you watch the mechanisms being built.
Then it becomes a fairly useful economic principle.
This does not mean every restriction fails. Some will work extremely well. Some technologies really do have chokepoints that are difficult to replace, particularly semiconductor manufacturing. Time matters too. Making something five years harder can be strategically significant even if the barrier is eventually overcome.
But restrictions rarely produce only the behaviour their designers intended.
They change incentives.
And incentives create markets.
Restrict the most advanced chips and you increase the value of building domestic ones.
Make compute expensive and efficiency becomes more valuable.
Restrict frontier-model access and proxies appear.
Make official inference expensive and people arbitrage subscriptions.
Try to protect the capabilities of the strongest models and those capabilities themselves become something others will attempt to extract, imitate and distil.
At some point, the better question stops being:
Can we build a wall high enough?
It becomes:
What will people build because the wall exists?
China’s strange market for three-cent Claude is one small answer.
I doubt it will be the last.