Researcher says 6TB LLM call dataset from proxy service exposed credentials of 26 Chinese firms and labs
On September 11, 2026, security researcher Chaofan Shou disclosed on social media that he had purchased a 6TB dataset of Fable model API calls from a major domestic LLM proxy service provider for a five-figure sum in U.S. dollars. The unredacted request history contained a large number of credentials for core systems, including GitLab access tokens, SSH keys, VPN configuration files, and cloud account keys with high-level permissions.
According to Shou, the credentials alone were enough to take over internal systems of 19 technology companies, including Huawei, Xiaomi, NIO, and MiniMax, as well as seven national research institutions such as Zhangjiang Laboratory and the University of Science and Technology of China.
LLM proxies, also known as LLM routers, have emerged as gray-market infrastructure alongside the commercialization of overseas models. Due to restrictions on regional IP addresses, corporate accounts, and cross-border payments imposed by providers like Anthropic and OpenAI, many domestic developers and teams rely on third-party proxy services to call APIs. Any application-layer proxy without end-to-end encryption essentially acts as a traffic capture tool.
In earlier research, Shou and other researchers tested 428 LLM API routers. They found that nine actively tampered with agent instructions, 17 accessed deliberately planted AWS credentials, and one transferred ETH from a test wallet. The study also found that 91.1% of development sessions ran in YOLO mode without manual confirmation, and the team was able to gain control of about 400 downstream development hosts within hours.
Shou is chief engineer at Solayer Labs and a co-founder and former CTO of FuzzLand. He has earned about $1.9 million from bug bounties. In April 2026, he discovered that Anthropic had accidentally bundled a source map with the Claude Code 2.1.88 installer, allowing him to reconstruct nearly 510,000 lines of unobfuscated TypeScript source code.
