Unauthorized OpenAI Codex and Claude Code Relays Disable AI Sandboxes and Redirect Enterprise Data

A grey market relay service is quietly installing the real OpenAI Codex and Anthropic Claude Code tools on company computers. It then changes their settings so that every prompt, file and login token goes through servers the service controls.

The service has been active since at least early 2026 and has touched about a dozen organizations, most of them in mainland China. Some are local branches of firms based in South Korea, Taiwan and Malaysia.

The affected companies work in industrial automation, electronics, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals and data center services.

Employees in these places often cannot buy Western AI coding tools directly, so they turn to resellers. The same trust in AI developer tools is also what drives the malware stealing AI tool credentials that has been seen recently.

Analysts at Symantec’s Threat Hunter Team identified the relay service and described how it works in a Threat Hunter Team report.

They stress that this is not a flaw in Codex or Claude Code. The tools behave as designed once someone changes their configuration.

Unauthorized OpenAI Codex and Claude Code Relays

The service does not ship a fake or trojanized program. Users first install the genuine tool with a normal npm command. Within minutes, or up to about half an hour later, they run a one-line command that pulls a setup script from a lookalike domain such as vibe.aiok[.]me.

The script runs in memory without saving a file, checks that Node.js and the tool are present, and installs them quietly if they are not. Because the install is real and works, it looks routine to the user and to most monitoring tools.

Symantec saw no automated or exploit-based delivery. The command contains a relay-issued API key, and the script prints progress messages in Chinese. This suggests employees copy a ready-made command from the relay or a reseller and run it themselves.

The script then rewrites the config file, which is ~/.codex/config.toml for Codex and ~/.claude/settings.json for Claude Code. It swaps the base URL for a domain the relay controls and saves the relay’s key as a user-level environment variable, so it survives a reboot.

It also sets the sandbox mode to “danger-full-access”, turns on network access for the write sandbox, and turns off telemetry and error reporting. That last step also hides usage signals from OpenAI and Anthropic.

On one host, the script ran claude /logout, deleted the Anthropic token and key variables, and ran claude /login. This clears a real session so it cannot override the relay’s credentials. Researchers could not say whether this happens on every machine.

Several hosts also checked the Windows region setting after installation, which may confirm the system is in the market the service targets.

Attackers can also change these same files without a relay. Researchers have shown that malicious files in Downloads can trick the tools into editing their own settings.

Why Enterprise Data Is at Risk

A relay in this position sees every prompt, file and secret an employee sends to the agent. It can also change or invent any reply. With the sandbox off and network access on, a bad reply could run commands with the full rights of the user’s account.

Symantec found no sign that the operator has done this. The changes were observed, but the risks that follow from them are potential.

The credentials also do not stay inside the AI tool. Any other program on the same machine that reads those environment variables can pick them up, which widens the exposure.

The operator’s goal is unclear. Getting around regional limits is the simplest explanation, but it does not require turning off the sandbox. The Claude Code keys the relay issued start with sk-ant-oat01-, the prefix for subscription logins.

That fits a service pooling flat-rate subscriptions and splitting them among many customers. Fraud and resale of the prompts and files that pass through the relay cannot be ruled out.

Sandboxes already have a shaky record. Earlier research found a Claude Code network sandbox bypass that stayed open for over five months.

Past cases also show how little it takes to lose AI logins. One npm package stole Codex authentication tokens while posing as a helpful interface.

Defenders should watch endpoints running these tools for several signs. Look for changes to base_url or ANTHROPIC_BASE_URL in config files. Look for sandbox_mode set to “danger-full-access”, and for OPENAI_BASE_URL, CODEX_API_KEY or ANTHROPIC_AUTH_TOKEN set as user-level variables outside approved deployments. Look for a PowerShell iwr | iex or bash curl | bash command run soon after an npm install of these tools.

Also limit traffic from AI tools to an approved list of AI service endpoints. Symantec says its endpoint products block these files when they are available for analysis.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Unauthorized OpenAI Codex and Claude Code Relays Disable AI Sandboxes and Redirect Enterprise Data appeared first on Cyber Security News.