Finding the hydra.

The problem, as published

On February 23, 2026, Anthropic reported that three China-based labs had generated over 16 million exchanges with Claude through roughly 24,000 fraudulent accounts, using commercial proxy services built as "hydra cluster" architectures. One proxy network ran more than 20,000 accounts at once and mixed extraction traffic with unrelated customer requests. The campaigns were identified by synchronized traffic, identical prompt structures, shared payment methods, coordinated timing, volume concentrated in narrow areas, chain-of-thought elicitation, and one lab redirecting nearly half its traffic within 24 hours of a model release.

The September 2026 threat report added the market around it: resellers rotating stolen keys through proxies so traffic blends with the owner's, account factories banking verified accounts for later, and a reseller that sold "cheap Claude access" while silently proxying to a different model and harvesting credentials.

The unit of abuse in every case is a network. So the unit of triage has to be a network too.

What I built

A small pipeline on labeled synthetic logs, because real logs are not mine to have. The code is public at github.com/jjjuras/hydra-triage. Thirty days of hourly usage for 3,810 accounts: developers, enterprises, researchers, and five legitimate companies written in as honest correlation (one product, one shift, shared templates, a model switch on a morning IT picks), plus three distillation rings, two reseller proxies, two account farms, and forty stolen keys, each built from the published signals. Every request carries its prompt as text and the model it went to. A new model ships on day twenty.

• No labels

  The first version joined accounts on a template id the generator had written down. That is an oracle. It is gone: prompt structure is now recovered from the text itself, by masking the payload and hashing what remains into families, so two prompts from one template with different contents land together and a fresh structure does not.

• Features

  Per account, all readable by a person: volume, burstiness, hour-of-day entropy, topic concentration, reuse of uncommon prompt structures, chain-of-thought rate, output-to-input ratio, distinct IPs, release-day shift, the share of the first day online after release that went to the new model, account age, promotional credit. Unmeasured is null, never zero.

• Linking

  Identifier edges: a shared card, a shared device, a prompt structure that is a habit on both sides, a shared IP across several hours. Behavior edges, for accounts that already carry evidence and at least a day of activity: the same hours and the same topics, or the same switch to the new model and the same topics. One axis alone is never an edge.

• Cases

  One case per component, ranked by weighted evidence rules plus cluster evidence. An isolation forest is a tie-break that can be switched off, so its worth is measured rather than assumed. Every case carries its reasons in words.

• Scoring

  Precision first, because a false positive here is a paying customer. The two numbers an analyst cares about: how many cases they work, and how many legitimate accounts they see, to reach ninety percent of the ring. Plus a stopping rule: work every case that scores six or more, then stop.

Results

Five seeds. Mean, with the range across seeds in brackets. Full tables in the repository.

Five worlds. At each level the ring stops sharing one more thing. Base shares everything. Then it jitters its schedule, spreads its cards, and dilutes its templates. Then it shares no cards, devices, or IPs. Then every prompt is a fresh structure. Then every account keeps its own schedule. What it never gives up is its topics and its move to the new model within hours of release, because that is what the ring is for.

3,810 accounts, 850 abusive in eight networks plus forty stolen keys. Precision in the threshold queue was 1.00 at every level in every seed.

Through the third level, identifiers do the work. The whole ring is three or four cases. Behavior edges add nothing and cost nothing.

When the templates go, the ring shatters. For an identifier linker it becomes hundreds of one-account cases; an analyst works 288 of them to reach nine tenths of the ring. Two-axis behavior edges reassemble it into about five cases, with no legitimate account seen on the way.

When the schedule goes too, one axis is left. Release-day co-movement, paired with topic, still recovers about eight tenths of the ring, at a cost of two legitimate accounts across five seeds. The rest are ring members whose first hour on the new model fell more than three hours from any other's. That is a limit of the window, and I have written it down as one.

What each axis costs alone. Topic similarity by itself recovers every ring by fusing all three rings, the resellers, and the stolen keys into one case of four hundred accounts that no one can act on. Release-day co-movement by itself sweeps in whichever company upgraded on release morning: up to 278 legitimate accounts in one seed. Requiring both axes removes that cost and keeps the recall. The isolation forest changed no number in any table. One axis of resemblance is a false-positive machine; two independent axes are not. That is SynchroTrap's lesson, and it held here.

What the build taught me

Most of what I know about this problem I learned from the method being wrong.

• Strangers

  The first template link, "any shared template," merged about 680 legitimate accounts into a ring the moment the attacker diluted its templates. Incidental overlap must never link strangers. The rule became a habit on both sides.

• Popular

  When the text fingerprint replaced the label, every legitimate account suddenly looked sixty percent templated, because everyone prompts the same few ways, and a 1,600-account blob swallowed the queue. A structure everyone uses is not a signature. Reuse now counts only structures used by fewer than a tenth of accounts.

• Bursts

  Account-farm accounts live for an hour or three, all on the new model, each on one topic. They co-switched with everyone and chained two rings and the stolen keys into one 560-account case. Co-movement needs something to move: a day of activity and a history to redirect from.

• Ceilings

  Precision at 25 cannot exceed 0.32 in a world with eight networks, however good the ranking. The first version of this post reported it as if it meant something. The number an analyst needs is how far down the queue they go, and whom they meet.

The research question

What else moves together when the attacker has stopped moving together on purpose?

At the last level the ring is held together by one thread: it still wants the new model the hour it ships. An attacker who reads this post waits a week. Then the body is invisible again. The signals I would test next, with real logs and four months: similarity in what the outputs look like, not just what the prompts ask; co-movement on things the attacker does not control, like rate limits and outages; and whether the one-wrong-edge problem of transitive linking yields to a method that asks for a second, independent edge before fusing two components. Each is a hypothesis with a measurable cost in false positives.

References

Model extraction and distillation. Hinton, Vinyals and Dean, Distilling the Knowledge in a Neural Network (2015). Tramèr et al., Stealing Machine Learning Models via Prediction APIs, USENIX Security 2016. Orekondy, Schiele and Fritz, Knockoff Nets, CVPR 2019. Krishna et al., Thieves on Sesame Street, ICLR 2020. Carlini et al., Stealing Part of a Production Language Model, ICML 2024. Kirchenbauer et al., A Watermark for Large Language Models, ICML 2023.

Coordinated-account detection. Cao, Yang, Yu and Palow, SynchroTrap, CCS 2014. Beutel et al., CopyCatch, WWW 2013. Hooi et al., FRAUDAR, KDD 2016. Liu, Ting and Zhou, Isolation Forest, ICDM 2008. The synchrony measure here is the lockstep idea from SynchroTrap and CopyCatch applied to hourly API activity. The camouflage problem FRAUDAR names is exactly the hydra's cover traffic.

Threat reporting. Anthropic, Detecting and preventing distillation attacks, February 23, 2026. Anthropic, Countering misuse of AI: September 2026. CNBC, September 11, 2026. TechCrunch, February 23, 2026.

Honest limits

The data is synthetic. The numbers measure the method against archetypes I wrote from published descriptions, not against real attackers. Thresholds were set by hand on seed one and then reported over seeds one through five, so seed one is not a held-out test. Linking is transitive, so one wrong edge fuses two networks, and the sweep shows that happening below an activity threshold of 0.5. In some seeds the text fingerprint still joins a handful of legitimate accounts to a reseller through a popular prompt structure; those cases score below the threshold. Nothing here is a claim about any real account. The code is small on purpose, so that every number in the table can be traced to a line.

AI Security · Guard before, audit during · All writing