Underground AI Account Prices Surge Amidst Rising Cybercrime in 2026

• •Underground prices for stolen AI accounts have more than doubled in 2026.
• •The vendor Poison Claude sells access to AI models at a fraction of official prices.
• •The operation uses free credits and cryptocurrency, posing significant risks to data security.

In 2026, the average prices for stolen AI accounts, including Claude, Gemini, and Cursor Pro, have more than doubled according to Google's Threat Intelligence Group. A vendor known as Poison Claude is selling access to Anthropic's Opus models at only 5-15% of the official pricing, utilizing free bonus credits from services like AWS Bedrock. This vendor operates by farming free credits and accepts cryptocurrency payments. The operation was traced through a 7 GB infostealer log dump shared on Telegram. The architecture of Poison Claude allows it to act as a proxy, enabling it to intercept and potentially modify user prompts and responses. The rise in underground marketplace activity indicates a growing illicit ecosystem targeting AI models. This trend is corroborated by reports of numerous safety incidents at companies like OpenAI and Anthropic. Neither Google nor Okta provided specific dollar ranges for the accounts, indicating a general increase in illicit activity rather than precise pricing.