AI bypass repos are climbing GitHub trending — and staying there

What happened

Three repositories are on GitHub trending this week, and if you squint they look unrelated: `yynxxxxx/Codex-5.5-codex-instruct-5.5` (score 1,312), `akihitohyh/chatgpt-register-sub2api` (score 173), and `LinXiaoTao/FuckClaude` (score 307). Different authors, different vocabularies, different framings. But the payload is the same in every case — unauthorized or semi-legitimized access to a paid AI provider.

The Codex repo is dressed up like a model release, using a name that piggybacks on OpenAI's Codex line and the vague honorifics of a version bump ("5.5", "codex-instruct-5.5") that doesn't correspond to any product OpenAI ships. `chatgpt-register-sub2api` is more literal about what it does: automate the registration of ChatGPT accounts and expose them behind an OpenAI-compatible `/v1/chat/completions` endpoint, so any client that speaks the OpenAI API can hit the ChatGPT web UI backend as if it were a paid API key. `FuckClaude` isn't hiding the intent in its name — it's a reverse-engineered client for Anthropic's Claude products, papered over with the same OpenAI-compatible façade.

The shared thread isn't the code — it's the business model. All three exist to convert something a vendor sells at one price (a ChatGPT Plus seat at $20/month, a Claude subscription, API tokens metered by usage) into something you can resell or consume at a different price, usually through an OpenAI-shaped proxy so downstream apps don't know the difference.

Why it matters

The interesting fact isn't that these repos exist — reverse-engineered clients for closed APIs are as old as closed APIs. The interesting fact is that they're on the front page.

GitHub trending ranks by star velocity: how quickly a repo is accumulating stars relative to a baseline. The algorithm has no notion of provenance, no ToS awareness, no ability to distinguish a legitimate kernel patch from a script that farms disposable email addresses to spin up ChatGPT accounts. A repo with a name that starts with "Fuck" and ends with a vendor name will sit next to the Linux kernel and Fable 5 in the same list, ranked by the same metric, presented to millions of developers as "what's hot right now."

A year ago this category still hid. Repos used euphemisms — "free-gpt," "gpt4free," "revChatGPT." The naming was cautious because DMCA takedowns and account bans were a real threat, and because there was still a norm against openly labeling a project as circumvention. That norm is visibly gone. `FuckClaude` doesn't apologize for what it is, and it's ranking anyway. The Codex repo goes the other direction and imitates a legitimate model release closely enough to fool a skimmer.

What's fueling the growth? Two things, in roughly this order. First, the economics of AI API access have gotten weird. A ChatGPT Plus seat gives you effectively unlimited chat throughput for $20/month; the equivalent through the paid API can run tens or hundreds of dollars for a heavy user. That price gap is a persistent arbitrage, and any arbitrage that persists gets tooled. Second, the OpenAI API has become a lingua franca — Cursor, aider, Cline, LibreChat, dozens of downstream apps all speak it — which means one working shim is enough to service an entire ecosystem. `sub2api` isn't clever code. It's a plug that fits every socket.

The vendors know this and their responses have converged: aggressive fingerprinting, TLS JA3/JA4 checks, behavioral rate limits, phone verification, and — quietly — cooperation with cloud providers to burn the IP ranges these proxies rely on. It's a treadmill. The proxies churn; the countermeasures churn faster; the fresh repo appears with a new bypass and briefly wins the arms race, which is when it hits trending. By the time you read about it, the working version is probably already broken. That's part of why the category regenerates so aggressively — every fix produces a new fork with a slightly different shim, and each fork gets its own star run.

One wrinkle worth naming: some of these repos are almost certainly SEO plays for paid reseller services. The pattern — a splashy README, a Telegram or QQ group link, a "pro" tier — recurs often enough to be a template. GitHub trending is free advertising for that funnel, and the funnel doesn't care whether the code works six weeks from now.

What this means for your stack

If you ship anything that gates on an AI vendor's API — a coding tool, a chatbot, a document QA product — your abuse surface just got wider and better documented. Assume every rate-limit you set, every fingerprint you rely on, and every "free tier" you offer has an off-the-shelf bypass being maintained by strangers. The defense stack that used to be "an API key is enough" now needs proof-of-work, per-account cost accounting, and outlier detection on request shape — not because your users are attacking you but because your users' tools are, sometimes without them knowing.

If you're a consumer of AI APIs, the temptation is obvious and the risk is real. These proxies leak prompts by design; the whole point is that a third party sits between you and the model. Anything you send goes through logs you don't control, on infrastructure that exists because the operator is monetizing your traffic somehow — usually resale, sometimes ads, occasionally training data. Treat any `sub2api`-style endpoint as if it were a public pastebin with your prompts on it, because functionally that's what it is.

And if you rely on GitHub trending as a discovery signal — which many devs still do — recalibrate. The list is now a mix of legitimate projects, marketing stunts, coordinated star campaigns, and openly adversarial tooling, all ranked by the same content-agnostic metric. A repo being trending tells you it's growing fast. It tells you nothing about what it is.

Looking ahead

The honest question isn't whether GitHub will clean this up — the moderation cost of policing every reverse-engineered client at the pace they appear is not tractable, and takedowns just fork the repo to a new account. The question is whether the vendors change the economics enough to kill the arbitrage. A ChatGPT Plus seat priced closer to real inference cost, or a Claude API tier that makes proxying uneconomic, would deflate this category faster than any legal action. Until then, expect the next "FuckClaude" and the next "sub2api" to trend on schedule, and expect the trending page to keep offering them next to the kernel.