How People in China Keep Outsmarting Anthropic’s Geolocation Restrictions

Anthropic goes to great lengths to prevent people in China from using its AI models, but its safeguards have often failed. Over the past year, startups, researchers, and tech enthusiasts across the country have developed increasingly sophisticated workarounds to access Claude, which many consider the world’s most capable AI assistant.

In early June, Anthropic publicly released Fable 5, a safeguarded version of its most powerful model yet, Mythos. Chinese social media immediately lit up with posts from people sharing their impressions. A few days later, Anthropic revoked access globally in response to export controls imposed by the Trump administration.

Chinese users can generally access other Western AI tools like OpenAI’s ChatGPT by using VPNs, foreign phone numbers, and international payment methods. But Anthropic has taken more aggressive steps, such as banning accounts suspected of being owned by people in China. Users frequently report being suspended without warning despite taking precautions.

This cat-and-mouse game has fueled a thriving underground economy for Claude access in China. Accounts are sold on platforms like Taobao and Telegram. More recently, a cottage industry of "transfer stations" has emerged: these services purchase access to Anthropic’s API outside China and redistribute Claude API tokens to users inside the country, providing more stable access for professionals.

Michael Aciman, a spokesperson for Anthropic, says the company uses evolving detection systems, including identity verification, to enforce policies. He added that Anthropic has worked to detect and disrupt proxy networks used to provide access in China.

Despite difficulties, Claude remains popular in China, especially among programmers. Although Chinese companies like DeepSeek and Z.ai have capable open-source models, third-party tests show they still lag behind leading closed models like Claude. During a recent trip to China, WIRED spoke to academics and engineers who said they prefer using Claude over Chinese models for coding and are eager to try each new release.

Zilan Qian, a research associate at the Oxford China Policy Lab, studied the black market for reselling Western AI tokens. He noted that Chinese software developers overwhelmingly prefer Claude Code and OpenAI’s Codex over domestic tools. "Analysis shows Chinese models are still six to nine months behind US models, and for specific things like coding, you can obviously tell the gap," Qian says.

Matt Sheehan of the Carnegie Endowment says Chinese policymakers and technical people have fewer qualms about using American products regardless of geopolitical rivalry. "It’s Americans who tend to think an idea or product is tainted just because it comes from their rival," he says.

Anthropic CEO Dario Amodei often singles out Chinese access to frontier models as a threat to US national security. This week, Anthropic accused Alibaba of using Claude outputs to train rival models via "distillation." For these reasons, Anthropic does not offer commercial access to Claude in China or to subsidiaries of Chinese companies abroad.

Still, people find workarounds. Casual users stick with VPNs and consistent proxy locations. Less technical users buy pre-set-up Claude accounts on Taobao or Xianyu; even if Anthropic bans them eventually, it's acceptable for brief use.

Similar markets exist on Telegram, says Hieu Minh Ngo, a reformed hacker turned investigator. These underground Chinese-language marketplaces focus on selling "pro" accounts that allow more prompts.

The demand for AI agents has also risen, as they consume more tokens. Heavy users, especially developers, need affordable, reliable access. Transfer stations act as middlemen: users send prompts to a local website, which forwards them to Claude via individual accounts or API keys. They often charge cheaper prices than direct API access due to enterprise discounts.

Today, Chinese-language websites and GitHub pages list dozens of transfer stations comparing models and prices. Even Chinese crypto billionaire Justin Sun opened his own transfer station in May.

The number of Chinese users accessing Claude via proxies may distort global usage data. Singapore, a country of 6 million, often appears among top countries for Claude adoption relative to population, likely because Chinese users fake their location there.

Anthropic continues tightening restrictions. In April, it rolled out identity verification for some users via Persona, requiring a government-issued photo ID. IDs from unsupported countries don't count, and failure can lead to account banning.

This has shifted the black market toward fake identities. Ngo says Chinese Telegram channels now advertise Claude accounts that have already passed identity checks. "They talk about how to bypass KYC, where to buy the Claude KYC so they can use it," Ngo says.

Perhaps it's time to acknowledge that no matter how strictly Anthropic enforces restrictions, as long as models are publicly released, users in China and other unsupported countries will likely continue to find ways to use Claude. Black markets are always ready with turnkey solutions.

But accessing Claude through unsanctioned tools exposes users to security risks. They can be scammed on Telegram, and transfer stations may package and sell sensitive information. "People working on AI safety need to think, if this transfer station infrastructure remains, how are you going to monitor bad actors?" Qian says.