← All incidents

Symantec says an unauthorized relay service reconfigures genuine Codex and Claude Code CLIs to route traffic through its servers with the sandbox switched off

Research · OpenAI Codex CLI and Anthropic Claude Code CLI (genuine tools reconfigured by an unauthorized relay service; not a flaw in either tool) · MEDIUM

Summary

Symantec's Threat Hunter Team says an unauthorized relay service installs the genuine OpenAI Codex and Anthropic Claude Code command-line tools on company computers, then reconfigures them so every request goes through the relay's own servers instead of OpenAI's or Anthropic's. In a report published Oct 29, 2026, Symantec says the setup script switches the tools' sandboxing off, in Codex's case by setting it to "danger-full-access", replaces the user's real API credentials with relay-issued tokens, and disables telemetry and error reporting. Symantec is clear that this is not a bug in either tool: "This is not a vulnerability in Codex or Claude Code. The tools are behaving as designed once their configuration has been changed." It says users appear to run the setup command themselves, and that it did not observe any automated or exploit-based delivery. Symantec says the service has been active since at least early 2026 and "has impacted systems at a dozen organizations, most of them in mainland China, as well as multinational subsidiaries based in South Korea, Taiwan, and Malaysia." It says there is "no evidence so far that the relay operator has abused this level of access", but that a potential risk is that the configuration would let the operator "read every prompt, file, and secret passed through the agent and run commands with the user's full privileges." Symantec notes that OpenAI and Anthropic do not officially sell their coding agents into mainland China, and says most cases look like workplaces where an employee or the organization turned to an unauthorized reseller to get the tools.

Severity

Timeline

1. Early 2026
   Symantec says the relay service has been active since at least early 2026.
2. Oct 29, 2026
   Symantec's Threat Hunter Team publishes its report, with file hashes and network indicators for the setup scripts and relay domains.

How it happened

Symantec says the service "does not distribute a modified or trojanized client." Users install Codex or Claude Code from npm as normal, and within minutes to roughly half an hour, a fileless PowerShell or bash setup script runs. It is fetched from a lookalike domain with a one-line command, checks whether Node.js and the CLI are installed, installs them silently if not, and then applies its own configuration. Symantec says it did not observe any automated or exploit-based delivery. The one-line command embeds a relay-issued API key and the relay's endpoint, and the script prints progress messages in Chinese and tells the user to re-run it in an elevated PowerShell session if it lacks administrator rights. Symantec says that indicates users copy a ready-made command from the relay or its reseller and run it themselves, although it has not seen the page or message it was copied from. The script rewrites ~/.codex/config.toml for Codex or ~/.claude/settings.json for Claude Code. Per Symantec, it replaces the base_url (or ANTHROPIC_BASE_URL) with a domain the relay controls, swaps in a relay-issued API key, and establishes both as user-scope environment variables so the change survives a reboot. It also sets the sandbox mode to full access, enables network access for the write sandbox, and disables telemetry and error reporting. On one host, Symantec says, the script ran claude /logout, deleted the ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY environment variables, and ran claude /login before installing the relay's credentials. Symantec says it was not established whether that step runs in every deployment. It says the relay's backend has rotated across at least eight domains, "all impersonating OpenAI- or Anthropic-branded chat services." Symantec says why an operator would want this degree of control "is unclear". It calls bypassing regional restrictions the simplest explanation, but notes that this does not require disabling the sandbox or setting credentials that survive a reboot. It calls reselling capacity below market rates another possibility, and says fraud involving stolen credentials or payment cards, and resale of the prompts and files that pass through the relay, are also plausible and cannot be ruled out with the evidence available. Because the relay's credentials are user-scope environment variables, Symantec adds, other tools on the same machine that read those variables can pick them up. Symantec stresses that the configuration changes were observed and "the risks that follow from them are potential."

How to check your app

• Look at the base URL in your CLI config: ~/.codex/config.toml for Codex and ~/.claude/settings.json for Claude Code. Symantec says the relay replaces base_url, or ANTHROPIC_BASE_URL for Claude Code, with a domain it controls. If it points somewhere you did not choose, we suggest finding out who set it.
• In ~/.codex/config.toml, look for sandbox_mode = "danger-full-access" and network_access set to true. Symantec shows the script writing both, and lists sandbox_mode set to "danger-full-access" as a sign to watch for.
• Look for DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1, which Symantec shows the script setting.
• Check your user-level environment variables for OPENAI_BASE_URL, CODEX_API_KEY and ANTHROPIC_AUTH_TOKEN. Symantec flags these when they are set as user-scope variables outside an approved deployment process. Remember that other tools on the machine can read them too.
• Think back to how you installed the CLI. Symantec lists a PowerShell iwr | iex or bash curl | bash command run shortly after, or in place of, npm install -g @openai/codex or @anthropic-ai/claude-code as a sign to watch for, and says the one-line command it saw carried the relay's key and endpoint. Its report lists the domains and file hashes it saw.
• Symantec says a relay in this position sees every prompt, file and secret an employee sends to the agent. If you find these settings and did not put them there, we suggest treating anything you sent through the agent as seen by the relay operator, rotating any secrets it handled, and bringing in your security team.
• For teams, Symantec suggests watching for traffic from AI CLI tools to destinations outside an allow-list of approved AI service endpoints.

Sources

• Symantec Threat Hunter Team (SECURITY.COM): Sandbox Flipped to 'Danger-Full-Access': Unauthorized AI Relays Create Risk for Organizations (Oct 29, 2026). Primary source

Corrections and updates

None. Re-checked against every source on Oct 29, 2026.