Unauthorized AI Relay Disables Codex and Claude Code Sandboxes
Summary
Symantec found an unauthorized AI relay on systems at about a dozen organizations that redirects Codex and Claude Code traffic, disables safeguards, and replaces credentials. Researchers observed no malicious activity, but say the setup creates serious risk.
Key points
- Symantec found the relay on systems at about a dozen organizations, primarily in mainland China and also in South Korea, Taiwan, and Malaysia.
- The service installs genuine Codex and Claude Code command-line tools but routes requests through its own infrastructure.
- A user-run PowerShell or bash script reconfigures the tools; researchers said the clients were not modified or Trojanized.
- The configuration disables execution sandboxes, enables network access for the write sandbox, and replaces users’ API credentials with relay-issued tokens.
- Researchers observed no malicious activity and said the operators’ intentions remain unclear; potential motives discussed in the report are speculative.
- The relay could access prompts, files, and secrets sent through it, and altered responses could run with the user's account privileges when safeguards are disabled.
Article Details
- Event Type
- An unauthorized AI relay service installs genuine OpenAI Codex and Anthropic Claude Code command-line tools, routes their requests through relay infrastructure, and changes security settings. Symantec reported no observed malicious activity or confirmed compromises.
- Impact
- The service disables execution sandboxes, enables network access for the write sandbox, and replaces user credentials with relay-issued tokens. Symantec warned that the relay could access prompts, files, and secrets, alter responses, and—if a response were malicious or the relay compromised—enable code execution with the user's account privileges. The tools were reported on systems at about a dozen organizations, primarily in mainland China, as well as South Korea, Taiwan, and Malaysia.
People
Vendors
AnthropicA mysterious relay service is installing authentic but unauthorized OpenAI Codex and Anthropic Claude Code tools for enterprise users overseas, and making dangerous configuration changes that put those organizations atOpenAIA mysterious relay service is installing authentic but unauthorized OpenAI Codex and Anthropic Claude Code tools for enterprise users overseas, and making dangerous configuration changes that put those organizations at
Products
Claude CodeA mysterious relay service is installing authentic but unauthorized OpenAI Codex and Anthropic Claude Code tools for enterprise users overseas, and making dangerous configuration changes that put those organizations atCodexA mysterious relay service is installing authentic but unauthorized OpenAI Codex and Anthropic Claude Code tools for enterprise users overseas, and making dangerous configuration changes that put those organizations at
Countries
ChinaSymantec researchers noted that the service, which has been active since early 2026, has installed the tools on systems at a dozen organizations, primarily in mainland China but also in South Korea, Taiwan, and Malaysia.MalaysiaSymantec researchers noted that the service, which has been active since early 2026, has installed the tools on systems at a dozen organizations, primarily in mainland China but also in South Korea, Taiwan, and Malaysia.South KoreaSymantec researchers noted that the service, which has been active since early 2026, has installed the tools on systems at a dozen organizations, primarily in mainland China but also in South Korea, Taiwan, and Malaysia.TaiwanSymantec researchers noted that the service, which has been active since early 2026, has installed the tools on systems at a dozen organizations, primarily in mainland China but also in South Korea, Taiwan, and Malaysia.