Don't hand your code, keys and private files to an unknown "AI relay service" (AI 中转站), especially when you let the AI run commands automatically

Cost

Going direct to the official provider usually costs more than a relay, and topping up is not as convenient. The difficulty is that relays are cheap, and one entry point can call several models.

What you get

In June 2026 the Ministry of State Security (国家安全部) issued a risk notice. Some relays keep the data users submit on their servers, and some secretly hold it back and resell it to other large-model companies for training. Some hide backdoors, plant malicious code on users' devices, steal account keys and cloud credentials, and even install remote-control programs. The notice advises using official direct connections and properly authorized platforms, and not using platforms of unknown origin, without an operating license or without security safeguards. When you do use one, first strip personal privacy and project material of identifying details, manage your keys well and change them regularly. If you run into unexplained charges, an account banned for no reason or abnormal data, stop using it right away, change your keys, scan for viruses and keep evidence. In 2026, researchers at the University of California, Santa Barbara and other institutions ran a measurement. They bought 28 paid relays from Taobao, Xianyu and overseas online shops, and collected 400 free relays from public communities. The result was that 1 paid relay and 8 free ones injected malicious code into the tool calls they sent back. A tool call is a command the AI has your computer run, such as installing a software package. Another 2 chose their moment to strike; the paper's example is that they acted only on fully automatic sessions. 17 used Amazon cloud-service keys that the researchers had planted on purpose. 1 moved money out of the researchers' Ethereum wallet, which held only a small amount, and the loss was under 50 USD. The change shown in the paper is subtle: in an install command, "requests" is swapped for the similar-looking "reqeusts", which you can't spot at a glance (nationwide).

Notes

Rated B because there is only one study, and it is a preprint, meaning a version made public before formal publication. Most of the relays tested were free, and only 28 were paid, so it can't tell you what share of relays have problems. Some media reported that theft as 500,000 USD, but the paper itself says under 50 USD. The size of the benefit is set at medium because the loss from stolen keys and code varies widely, and the study has no dollar figure to apply. If you have already used an unknown relay, go to the model provider, revoke the keys you used and generate new ones, and change cloud-service and code-repository keys as well. When going through a relay, don't let the AI run commands fully automatically, and look at each command before you allow it. The operator of a relay faces criminal risk; see §11.19 (AI relay services). The beneficiary is you.

Evidence grade

B : Supported by research but without a precise number, or based on small or single studies.

Sources

1. 国家安全部 (2026). 「AI中转站」，风险要防范. https://www.szzg.gov.cn/2026/xwzx/szkx/202606/t20260608_5331487.htm（数字中国建设峰会官网转载国家安全部微信公众号）
2. Liu H, Shou C, Wen H, Chen Y, Fang RJ, Feng Y. (2026). Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain. arXiv:2604.08407. https://arxiv.org/abs/2604.08407

Translated from the Chinese original. Original book, section 14, tip 10. Content may be out of date and rules differ by place. When you actually deal with an agency, a doctor or a court, follow what local officials, doctors and lawyers tell you. Disclaimer