Unauthorized AI Relays Disable Sandboxing in Codex and Claude Code

Oct 29, 2026 · Original article ↗

Summary

Symantec reports unauthorized relays reconfiguring genuine Codex and Claude Code CLIs at about a dozen organizations, disabling sandboxing and routing prompts and credentials through third-party servers. No operator abuse was observed, but the setup creates significant,

Key points

Symantec’s Threat Hunter Team observed the relay at about a dozen organizations since early 2026, mostly in mainland China, with some multinational operations in nearby markets.
A fileless PowerShell or bash script, apparently run by users shortly after a legitimate CLI installation, installs or reconfigures the genuine tools; no automated or exploit-based delivery was observed.
The script redirects requests to relay-controlled servers, replaces API credentials, disables the CLI sandbox, enables network access for the write sandbox, and turns off telemetry and error reporting.
On one host, the script logged the user out of Anthropic and removed existing authentication environment variables before setting relay credentials; whether this occurs elsewhere is unknown.
The investigation found no evidence that the operator abused its access. However, the relay could access prompts, files, and secrets and alter responses; user-scope credentials may also be read by other tools.
Symantec recommends monitoring CLI configuration and environment-variable changes, PowerShell or bash setup commands near CLI installations, and traffic to unapproved AI service endpoints.

Article Details

Attack Vectors: Users appear to run a one-line PowerShell or bash command shortly after legitimately installing Codex or Claude Code; the command fetches a setup script from a lookalike domain.
The setup script rewrites the CLI configuration to route requests through relay infrastructure, replaces the user's API credentials with relay-issued tokens, disables the sandbox, and enables network access for the write sandbox.
On at least one host, the script logged the user out of a legitimate Anthropic session, removed authentication environment variables, and then initiated a new login. The article says it is unknown whether this occurred in every deployment.
The article reports no evidence that the relay operator has abused its access. The configuration could nevertheless expose prompts, files, and secrets to the relay and allow commands to run with the user's privileges.
Defensive Notes: Monitor Codex and Claude Code configuration files for unexpected changes to base_url or ANTHROPIC_BASE_URL, and for sandbox_mode set to "danger-full-access".
Review user-scope environment variables for OPENAI_BASE_URL, CODEX_API_KEY, or ANTHROPIC_AUTH_TOKEN set outside an approved deployment process.
Look for PowerShell iwr | iex or bash curl | bash invocations shortly after, or instead of, npm installation of Codex or Claude Code.
Monitor AI CLI traffic for destinations outside approved AI service endpoints.
Symantec advises consulting its Protection Bulletin and says Symantec Endpoint products will detect and block an IOC when the file is available to them.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`aiok[.]me`	Domain listed among the relay's network indicators.
DOMAIN	`chat[.]nuoda[.]vip`	Relay endpoint domain listed as a network indicator.
DOMAIN	`claudechn[.]com`	Domain listed among the relay's rotating network infrastructure.
DOMAIN	`mirbuds[.]com`	Domain listed among the relay's rotating network infrastructure.
DOMAIN	`nuoda[.]vip`	Domain listed among the relay's rotating network infrastructure.
DOMAIN	`rawchat[.]cn`	Domain listed among the relay's rotating network infrastructure.
DOMAIN	`sharedchat[.]cc`	Domain listed among the relay's rotating network infrastructure.
DOMAIN	`sorryios[.]io`	Domain listed among the relay's rotating network infrastructure.
DOMAIN	`vibe[.]aiok[.]me`	Lookalike domain used to deliver the relay setup scripts and identified as relay infrastructure.
DOMAIN	`vibe[.]skk[.]moe`	Domain listed among the relay's network indicators.
SHA256	`2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24`	Hash of the fileless PowerShell downloader identified as impersonating an OpenAI Codex CLI setup script.
SHA256	`4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb`	Hash of the fileless PowerShell/bash downloader identified as impersonating an Anthropic Claude Code CLI setup script.
URL	`hxxps[:]//chat[.]nuoda[.]vip`	Relay service endpoint listed as a network indicator.
URL	`hxxps[:]//chat[.]nuoda[.]vip/claude`	Claude Code relay endpoint listed as a network indicator.
URL	`hxxps[:]//chat[.]nuoda[.]vip/codex`	Codex relay endpoint listed as a network indicator.
URL	`hxxps[:]//chat[.]rawchat[.]cn/codex`	Codex relay endpoint listed as a network indicator.
URL	`hxxps[:]//chat1[.]sorryios[.]chat/claudecode`	Claude Code relay endpoint listed as a network indicator.
URL	`hxxps[:]//chat1[.]sorryios[.]io`	Relay service endpoint listed as a network indicator.
URL	`hxxps[:]//chat1[.]sorryios[.]io/codex`	Codex relay endpoint listed as a network indicator.
URL	`hxxps[:]//claudechn[.]com/codex`	Relay endpoint listed as a network indicator.
URL	`hxxps[:]//gpt4[.]mirbuds[.]com/codex`	Codex relay endpoint listed as a network indicator.
URL	`hxxps[:]//new[.]sharedchat[.]cc/codex`	Codex relay endpoint listed as a network indicator.
URL	`hxxps[:]//rawchat[.]cn/codex`	Codex relay endpoint listed as a network indicator.
URL	`hxxps[:]//vibe[.]aiok[.]me`	Lookalike relay URL associated with delivery of the setup scripts.
URL	`hxxps[:]//vibe[.]aiok[.]me/setup-claudecode.ps1`	URL of the setup script identified as a downloader impersonating a Claude Code CLI setup.
URL	`hxxps[:]//vibe[.]aiok[.]me/setup-codex.ps1`	URL of the PowerShell setup script identified as a downloader impersonating a Codex CLI setup.