Security researcher Shou Chaofan said he purchased about 6TB of Fable model invocation data from a Chinese large-model relay station and found sensitive credentials that he said were sufficient to access servers or internal systems linked to 19 Chinese companies and seven government-related agencies.

According to Shou, the purchased dataset contained SSH keys, VPN configurations, Alibaba Cloud keys, and GitLab tokens. He said those credentials could provide access to the systems of entities including Huawei, Xiaomi, NIO, and MiniMax, as well as several government-related organizations in China and the CIS region.

The reported exposure centers on a large-model relay station, which acts as an intermediary that transmits requests and responses between users and AI models. Because that setup allows the relay station to see complete plaintext traffic, sensitive data included in prompts or context windows may be stored or resold by the intermediary, creating a path for credential leakage.

Shou said he had previously warned about the risks tied to relay stations. In a broader test of 428 LLM relay stations, he found that nine actively injected malicious code, 17 called AWS after seeing test keys, and one redirected ETH from a test wallet. The disclosure links AI application infrastructure risk with more familiar supply-chain and credential-management failures.

Shou is a co-founder of blockchain security firm Fuzzland and has focused on vulnerability and supply-chain security research. The available details do not include public responses from the named companies or agencies, nor do they specify how long the data had been retained, who operated the relay station, or whether the credentials were still active when reviewed.

Why It Matters

The case highlights an emerging security gap in AI infrastructure: intermediary services that sit between users and models may become high-value collection points for secrets far beyond model prompts. When developers place operational credentials inside AI workflows, a relay station can turn a convenience layer into a broad enterprise exposure point.

For crypto and AI-linked businesses, the significance goes beyond one alleged dataset sale. The same failure mode can affect cloud access, code repositories, and wallet-related operations, making AI tooling security a more immediate part of infrastructure risk rather than a separate application-layer concern.