Unauthorized Code Relays for OpenAI Codex and Claude Disable AI Sandboxes and Divert Enterprise Data

An unauthorized relay service for AI coding tools has been found installing legitimate OpenAI Codex and Anthropic Claude Code clients on corporate machines, then changing their configurations so requests are routed through third-party servers. The installation also disables sandbox protections, creating a channel by which sensitive business data can leave approved systems.

Symantec’s Threat Hunter Team described the activity in a report published October 29. Researchers observed the relay across roughly a dozen organizations beginning in early 2026.

Most affected hosts were located in mainland China, with other incidents impacting organizations tied to South Korea, Taiwan, and Malaysia. Industries observed include semiconductors, pharmaceuticals, shipping, electronics, petrochemicals, and data center services.

How the relay operates

The issue is not a modified Codex or Claude Code client nor a direct vulnerability in those tools; rather, the attackers alter the official clients’ configuration so they use relay-controlled infrastructure.

Researchers saw operators deliver a fileless PowerShell or bash downloader from lookalike domains such as vibe.aiok[.]me. In many cases, a user runs a setup command shortly—often within minutes to half an hour—after installing an AI coding tool via npm. The script checks for Node.js and the requested CLI, installs any missing components, then applies the relay configuration. Because the installed client remains functional, the additional setup step can appear routine to users.

The downloader edits configuration files such as ~/.codex/config.toml and ~/.claude/settings.json, replacing values like base_url or ANTHROPIC_BASE_URL with relay endpoints and installing credentials issued by the relay operator. It also writes user-level environment variables so the changes persist after restart.

In one observed sequence the script executed claude /logout, removed ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY, then ran claude /login, effectively clearing the prior session before the relay credentials took over. Symantec could not confirm this exact sequence for every deployment.

The relay modified sandbox protections inside Codex by setting sandbox_mode to danger-full-access, enabling network access for the write sandbox, and suppressing telemetry and error reporting with DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1. Those changes remove important safeguards while also reducing signals that might alert vendors.

The operator cycled through at least eight domains impersonating OpenAI- or Anthropic-like services. Researchers noted that some Claude tokens were issued on a subscription-like basis—consistent with pooled account resale—but said this observation did not prove the service’s exact business model.

Related reporting has shown a separate method that hijacks Codex and Claude Code through malicious files placed in Downloads folders; the relay activity described here differs because the setup script directly changes client settings rather than relying on instructions embedded in files.

Risk and evidence

The relay can read prompts, uploaded files, and any secrets sent through it, and it could modify responses. With sandbox protections disabled, a malicious response could cause commands to execute under the user’s account. Symantec reported no evidence that the operator exploited this capability; observed redirection is not the same as confirmed data exfiltration.

This campaign underscores why permission and sandbox controls matter: legitimate, unmodified software can become unsafe when an unapproved service controls its configuration.

Recommended defenses

• Audit endpoint URLs configured in AI tooling, sandbox settings, and user-level credential environment variables.
• Investigate any PowerShell or bash download-and-execute commands that run shortly after npm installs of AI coding tools.
• Use network monitoring to flag coding tools contacting destinations outside your approved AI endpoints; be aware that relay-issued environment variables can be inherited by other applications.
• Analyze suspicious setup scripts before they reach developer systems. Interactive analysis platforms such as ANY.RUN let defenders run samples in a contained environment with live interaction and network reporting to aid triage.

Indicators of compromise (IoCs)

Note: IP addresses and domains above are intentionally defanged (for example, using [.]) to prevent accidental resolution or hyperlinking. Re-fang only inside controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from thousands of SOCs.