Unauthorized AI relay disables Codex and Claude Code sandboxes

Symantec’s Threat Hunter Team has identified an unauthorized service that resells access to OpenAI Codex and Anthropic Claude Code while stripping away key security controls. The relay has appeared on systems at a dozen organizations, mostly in mainland China, with additional cases involving companies in South Korea, Taiwan and Malaysia.

Users install the genuine command-line clients, then run a one-line PowerShell or bash setup command supplied by the relay. That script changes the vendor endpoint to third-party infrastructure, replaces legitimate credentials with relay-issued tokens, disables telemetry and turns off the execution sandbox. In Codex, Symantec observed sandbox mode set to danger-full-access and network access enabled.

This is not a vulnerability in Codex or Claude Code: the tools behave according to a configuration that the user or relay changes. Symantec also says it has not seen the operator abuse its position. The risk is architectural: the relay can potentially see every prompt, file and secret sent through the agent, alter model responses and return commands that execute with the user’s full privileges.

Security teams should audit AI coding clients for unexpected base URLs, user-level API environment variables, disabled sandboxes and shell installers run after npm installation. Organizations should also allow-list approved AI endpoints instead of treating a working third-party relay as trusted infrastructure.