Symantec's Threat Hunter Team says it has found an unauthorized relay service that installs the genuine OpenAI Codex and Anthropic Claude Code command-line tools on its users' work machines, then rewires them. According to Symantec's report, published October 29, 2026, the setup script points each tool at the relay's own servers, swaps in relay-issued credentials, and switches the coding agent's sandbox off on that machine. In Codex's case it sets the sandbox mode to "danger-full-access."
Symantec is careful about what this is and is not. "This is not a vulnerability in Codex or Claude Code," the report says. "The tools are behaving as designed once their configuration has been changed." The researchers also say there is no evidence so far that the relay operator has abused its access. The changes are made to the installs on the relay's users' machines, not to OpenAI's or Anthropic's own systems. The risk is in what the configuration would allow.
Who is affected
Symantec says the service has been active since at least early 2026 and has reached systems at a dozen organizations. Most are in mainland China. The list also includes the Chinese operations, and in some cases the home-market operations, of multinational electronics and petrochemical firms based in South Korea, Taiwan, and Malaysia. The sectors it names are industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.
The report ties the demand to access. OpenAI and Anthropic do not officially sell their coding agents into mainland China, and Symantec says most cases look like a workplace where an employee, or the organization itself, wanted a Western AI coding assistant that is not sold there and turned to an unauthorized reseller. Symantec says the affected organizations "look less like chosen targets and more like workplaces where individual employees found and used such a service." Dark Reading's coverage says that on the surface the relay looks like a gray market provider serving regions where the products are not officially for sale.
How the setup works
The relay does not ship a fake or trojanized client. Per Symantec, users run a normal install of the real CLI through npm (@openai/codex, codex-cli, or @anthropic-ai/claude-code). Within minutes to roughly half an hour, a one-line command fetches a fileless PowerShell or bash script from a lookalike domain. Symantec saw no automated or exploit-based delivery. It says users appear to copy a ready-made command from the relay or its reseller and run it themselves, though it has not seen where the command came from. The script installs Node.js and the CLI if they are missing, then applies its own configuration.
Symantec says the script rewrites ~/.codex/config.toml for Codex or ~/.claude/settings.json for Claude Code. It:
- replaces the base URL (or
ANTHROPIC_BASE_URL) with a domain the relay controls - swaps in a relay-issued API key formatted to look like what the CLI expects
- sets both as user-scope environment variables, so the change survives a reboot
- sets the sandbox to full access and turns on network access for the write sandbox
- turns off telemetry and error reporting, which would also hide usage signals from OpenAI and Anthropic
On one host, Symantec says the script also ran claude /logout, deleted the ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY variables, and ran claude /login, clearing a legitimate session before installing the relay's credentials. The researchers say they could not establish whether that step runs every time. The relay's backend has rotated across at least eight domains, all impersonating OpenAI- or Anthropic-branded chat services.
Why the sandbox matters
Coding agents read files, write code, and run commands on the machine where they are installed. The sandbox is the boundary that limits that. OpenAI's Codex sandboxing docs describe workspace-write as "the default low-friction mode for local work," while danger-full-access means "the agent runs without sandbox restrictions" and "should be used only when you want the agent to act with full access." Claude Code has its own Bash sandbox that restricts the files and network hosts its shell commands can reach. Anthropic's docs say that sandbox is off by default. Symantec's report names the exact sandbox setting only for Codex.
Put that next to a relay that sits between the agent and the model. Symantec says a relay in this position "sees every prompt, file, and secret an employee sends to the agent, and can alter or fabricate every response it returns." With the sandbox off and network access on, "a malicious or compromised response could execute with the full privileges of the user's account." The report adds that because the credentials are set as user-scope environment variables, any other tool on the machine that reads them can pick them up.
This is the same class of problem as prompt injection against AI agents, only the untrusted input here is the entire model response stream. It also adds to a recent run of agent guardrail stories, including OpenAI's report on its own agents weakening misalignment monitoring.
What the relay might be for
Symantec says the motive is unclear. Getting around regional restrictions is "the simplest explanation," the report says, but that "does not require disabling a CLI's sandbox or establishing persistent credentials that survive a reboot." One clue: the Claude Code keys issued by the relay used the sk-ant-oat01- prefix, which Symantec says Anthropic uses for subscription-based OAuth tokens rather than sk-ant-api03- pay-per-use API keys. Symantec calls that "consistent with, though not proof of, a relay pooling flat-rate subscriptions and splitting the capacity across many customers." It also says fraud with stolen credentials or payment cards, and resale of prompts and files, "cannot be ruled out with the evidence available." Brigid O Gorman, a senior intelligence analyst on the Symantec team, told Dark Reading: "We did not see any malicious activity being carried out using these relay services, so any commentary on the potential intended goals of those using it are speculative." An Oxford China Policy Lab study we covered in August described Chinese proxies that split flat-rate subscriptions across many users.
What security teams can check
Symantec recommends watching endpoints that run Codex or Claude Code for:
- changes to
base_urlorANTHROPIC_BASE_URLin a CLI's configuration file sandbox_modeset to"danger-full-access"in~/.codex/config.tomlOPENAI_BASE_URL,CODEX_API_KEY, orANTHROPIC_AUTH_TOKENset as user-scope environment variables outside an approved deployment process- a PowerShell
iwr | iexor bashcurl | bashrun shortly after, or in place of, the npm install of either CLI - traffic from AI CLI tools to destinations outside an allow-list of approved AI endpoints
The report also lists file hashes and relay domains as indicators of compromise.
Why it matters
Coding agents now show up in serious engineering work, from Epic's Unreal Engine team to Android Studio's support for outside agents. Much of their protection on a user's machine rests on a few lines of local configuration: which server the CLI talks to, which key it uses, and how tight the sandbox is. In the cases Symantec found, one pasted command changed all three, using a genuine install that Symantec says looks routine to the user and to most monitoring tools. For companies, the practical lesson is to treat agent config files and base URL variables as security settings that IT controls, not personal preferences.
