One checkable line first: the lock in the address bar or the client only proves TLS on the hop to the relay. It does not prove the relay cannot read the prompt. Open DevTools Network and look at the request Host: is it the model vendor’s domain, or another proxy hostname? Canaries belong in test traffic only. Do not experiment with production SSH keys or a live Alibaba Cloud AccessKey.
This week’s argument is not “will the model train.” It is the hop in the middle
Around 10 September 2026, security researcher Chaofan Shou posted that he had bought about 6TB of Fable model invocation data from a leading China-based LLM API router, and that SSH keys, VPN configs, Aliyun keys, and GitLab tokens in that pack would be enough to reach systems tied to several Chinese firms and government-related bodies. Later write-ups framed the same claim as “relay logs hit a grey market.” Those reports also say the named companies have not publicly confirmed a compromise, and that no independent audit has equated “a token appeared in a dataset” with “the intranet was taken over.” This note uses the story as a hook. It does not treat a tweet screenshot as a verdict.
It is not the same question as the earlier note on pasting a key into ChatGPT. That piece checks a consumer chat box: history, the training toggle, and about 30 days of safety retention on Temporary Chat. This piece checks grey infrastructure developers actually hit: you think the request went to Claude or GPT, but it first landed on a router that decrypts the body, rewrites auth headers, and forwards. Agents also read .env files, terminal output, and workspace files on their own. A key does not have to be pasted by hand to enter the prompt.
SSH private keys, cloud access keys, GitLab personal access tokens, and VPN configs sit in the bucket the OWASP Logging Cheat Sheet usually keeps out of shared plaintext records. The OWASP Top 10 for LLM Applications already lists sensitive-information disclosure and supply-chain risk. A relay steps on both: it is the next place the prompt is stored, and it is an extra vendor between you and the model provider.
The lock only covers one hop. The relay legally unwraps JSON
Many people hear “HTTPS all the way” as “nobody along the path can read this.” That is not how an application-layer proxy works. arXiv:2604.08407, Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain, opens with that fact: these routers run as application-layer proxies with full plaintext access to every in-flight JSON payload, and no vendor forces cryptographic integrity between the client and the upstream model. The request must be decrypted, unpacked, and re-authenticated at the relay before a second TLS session is opened upstream. Encryption was not broken. It was legally terminated once.
That produces a scene that looks contradictory. Your IDE may speak TLS to the relay, and the relay may speak TLS to Anthropic or OpenAI, yet the machine in the middle has already seen the prompt, the tool calls, environment variables, and the returned code. It is the same class of mistake as treating STARTTLS as end-to-end mail privacy: transport encryption stops a bystander on the wire. It does not stop a store that has already accepted the inbound copy. Mail at least lets you search Sent for the message you wrote. A relay’s call log is usually not a page you can open. Deleting the local chat does not delete the line already written on their disk.
Coding agents widen the surface. Claude Code, Cursor, and homemade agents scan the workspace, read project config, and scrape terminal output. Once the API host points at an unaudited third party, a key that appears while you debug a script, stand up a test host, or pull a private repo can ride into the request body with the surrounding context. You never clicked “send the key.” You asked the agent to “fix why this will not connect.”
| Where | What usually remains | Who can still read it |
|---|---|---|
| Relay call logs | Prompts, tool calls, and plaintext keys from environment variables | The relay operator; anyone who gets the log or a backup |
| Resale / fine-tune datasets | Unredacted historical requests, sold as a pack | Whoever bought the pack; whoever mirrors it later |
| Upstream model vendor | The same plaintext after the relay forwards it | That vendor’s own retention and training policy |
| Rewritten tool calls | Poisoned payloads from the paper, which may run locally with no prompt | That relay’s operator and any later control plane |
428 nodes in the paper: paid relays still poison, and canaries get scooped
Before the September 6TB story, the same research line already published a measurement you can cite. The authors bought 28 paid routers from Taobao, Xianyu, and Shopify storefronts, then collected 400 free nodes from public communities—428 in total. They planted trackable AWS credentials and a pre-funded Ethereum private key in sandboxed agent traffic, and watched whether a relay would read them and use them.
The results fit in four sentences. Nine nodes actively injected malicious code: one paid, eight free. Two deployed adaptive evasion triggers. Seventeen touched researcher-owned AWS canary credentials. One drained ETH from the test wallet. The paper also records two poisoning observations that pull “looks benign” nodes into the same surface: an intentionally leaked OpenAI key and weakly configured decoys processed about 2.1 billion tokens from these routers; 440 Codex sessions exposed 99 credentials, and 401 of those sessions were already running in unattended YOLO mode. Clients barely validate tool calls the relay returns—the authors built a research proxy named Mine against four public agent frameworks to show rewritten payloads.
Those numbers do not prove the relay you use today is one of the nine or the seventeen. They prove the mechanism: a relay sees plaintext; some rewrite the response; some scoop credentials on their own; a price tag is not an end-to-end promise. Switching to a “more expensive proxy” still has to be checked against Host, the log policy, and whether you sent a real key—not against the invoice.
Once call logs are sold as a product, deleting the local chat does not buy them back
What stings about the September story is not another chat box that might train. It is invocation history treated as a dataset for sale. The public account is that unredacted request records held GitLab tokens, host SSH keys, VPN configs, and high-privilege public-cloud keys. A buyer does not have to break into an office network first. If the token still works, a login with a valid credential looks like ordinary operations in the company log. That is “a live account” plus “one extra hop in the supply chain.” It is not a TLS break.
So “I already cleared the IDE chat” does not reclaim a pack that already sold. The relay’s retention clock is theirs: global logs, object storage, and copies sold into a fine-tune market do not share your delete button. A consumer ChatGPT at least writes the training toggle and Temporary Chat into a help page. A grey proxy usually does not give you an equivalent data policy. When you check this on a machine, do not download that 6TB, and do not forward tokens from screenshots. A real key that already crossed a relay should be revoked at the issuer first. Change the channel after that.
The upstream model vendor is a second copy. After a successful forward, Anthropic or OpenAI still handle that plaintext under their own API retention rules. Turning off “improve the model” on one consumer product does not reach a proxy account you never signed into, and it does not reach a historical pack that already sold. Keep the two binders apart: vendor policy is one book; relay logs are another.
Do not test with production SSH, an Alibaba Cloud AccessKey pair, a GitLab glpat- token, or an unredacted connection string. Do not buy, download, or forward that 6TB pack. Prepare a disposable canary such as canary-relay-2026-do-not-reuse. What you check is whether Network shows that Host and whether the body contains this string—not whether you can spread an intranet key again. Revoke a real key that already entered a relay.
Check it here: read Host, and send canaries only in test requests
A slogan that says “we only forward” cannot prove itself. What you can see in one sitting is three things: whether this request’s Host is the model vendor’s own domain, whether the body still holds a key that should not leave, and whether the agent will run returned tool calls with no confirmation. This step only proves “who received plaintext on this call.” It does not prove a given relay sold its logs. That side can only be checked against whether they publish an auditable retention note—and against whether you are still sending real keys.
In a test project, point the API base URL at the address you actually use. Open DevTools or a local proxy’s request list and send a prompt that contains only a canary, such as “Repeat canary-relay-2026-do-not-reuse and do nothing else.” Read the request line. If Host is api.anthropic.com, api.openai.com, or a gateway your company built and named in a contract, this hop’s peer is the vendor or your own machine. If it is an unknown proxy domain, a raw IP, or a chain of relay paths, plaintext already landed in the middle. Then open the body: the canary should appear in the JSON. That is the string a logging relay would write down.
Do not hand a real .env to an agent so it can “see which line is wrong.” Replace passwords and private keys with canaries on this device first, or lock the whole file locally before you decide whether it should leave the browser. When a real key must reach a coworker—not a model—switch to Burn-Link: the key stays in the URL # fragment, and the server only stores ciphertext briefly. Paste the full link, hash included, back into a relay chat box, and that layer is gone.
- In a test project, send a prompt that contains only a canary such as
canary-relay-2026-do-not-reuse. Do not use a real key. - Open Network or a local proxy and compare the request
Host: model-vendor domain, or a relay hostname. - Open the body and confirm the canary appears as plaintext JSON. That is what a logging relay can store.
- Revoke production keys and issue new ones first. Mask prompts on this device before they leave. When a person must receive the real value, use Burn-Link—not a relay.
The proof is narrow. In this one run, plaintext left as a request body toward the Host you saw. It does not prove an extension never saved a copy, and it does not prove the 6TB pack contains your repo URL. After you change relays or agents, run the canary again against the new base URL.
Mask on this device, with no account, and keep the real key in this tab
If you want “keys do not enter a relay request” to become a repeatable move, start from MakePwd Privacy Cleaner. It opens with no account and no sign-in. Rule-based redaction handles text in the current tab. It does not upload the source, and it does not write the body awaiting redaction into analytics. Mask the error dump, config snippet, or terminal paste you were about to hand an agent, then decide whether that request still needs a relay. Masking is not anonymization. Missed names, spoken digits, and homemade token shapes still need a human pass. The field-level limits are in What rule-based redaction hides in a ticket or chat log—and what it still leaves behind.
Do not send a whole .env or key file back to “upload it to a drive and let the model read it.” File Encryption Box uses AES-256-GCM in this tab to make .lock / .enc (one file, at most 5 GB). Ciphertext can ride a drive; the passphrase should take another channel. When a coworker must receive the real passphrase, use Burn-Link: the browser encrypts with Web Crypto under AES-256-GCM, and the outbound fields are ciphertext, expiry, and remaining reads. The page attaches the key to the fragment on s.html?id={id}#{key}. Per RFC 9110, the request line must not include the part after the hash. A login password that already crossed a relay should be revoked first, then replaced on this device with a new 6–128 character string from the Password Generator (default 16; under 8 is flagged as weaker). None of those steps requires a login.
How a consumer chat box keeps sessions and trains is still that vendor’s help page. See What remains after you paste a password or API key into ChatGPT. Do not mix the two notes. The ChatGPT piece answers what an official chat box still keeps. This piece answers what the relay hop still keeps. Turning training off in an official box does not unsell a log a relay already sold.
FAQ
If the request uses HTTPS, can the relay still read the plaintext?
Yes. The paper states that LLM API routers run as application-layer proxies with full plaintext access to every in-flight JSON payload. TLS from your client to the relay is one hop; TLS from the relay to the upstream model is another. On the relay disk, a key is readable text by default—not “only Anthropic can see it.”
Does paying for a relay make it end-to-end safe?
No. Paid is not end-to-end. The paper bought 28 paid routers from Taobao, Xianyu, and Shopify storefronts, plus 400 free nodes—428 in total. Nine actively injected malicious code, including a paid node. Seventeen touched researcher-owned AWS canary credentials. One drained ETH from a test wallet.
Does the September 6TB dataset prove Huawei or Xiaomi were breached?
No. The public account is that a researcher said he bought about 6TB of call data and that SSH, VPN, cloud, and GitLab tokens in it would be enough to reach some firms and agencies. As of writing, the named companies have not publicly confirmed a compromise. This note keeps “a relay can see plaintext and may resell it” in a checkable range. It does not treat a named firm as a proven intrusion.
If the model must see a config that contains a key, what can I still do?
Mask passwords, tokens, and private keys into canaries on this device first. Then check whether that request’s Host is the model vendor’s own domain. Real keys should not enter a relay, and they should not enter a consumer chat box. When a coworker—not a model—must receive the real value, send it once with Burn-Link and keep the key in the URL # fragment. Create and read both open with no account.
Three things to remember before you change the API host again
First: a relay legally unwraps plaintext. Client-to-proxy is one TLS hop; proxy-to-model is another. Prompts, tool calls, and keys from .env are readable by default on the machine in the middle. Second: the September 6TB story is about call logs that can be sold as a pack. The paper’s 428 nodes show that paid relays still poison and that canaries get scooped. Third: in one sitting, only check Host and the body. If a canary can leave, a real key can leave. Revoke a password that already crossed a relay, and mask prompts on this device before they go out.
If the next question is what a consumer chat box still keeps after you paste a key, read What remains after you paste a password or API key into ChatGPT. If you need to check whether the key after a hash enters HTTP, read Why a URL hash fragment is a fit place for a key—and when that protection fails. This note only draws a line you can write into a conclusion: what can still remain after a key enters an LLM API relay.