Unauthorized relays disable Codex and Claude Code sandboxes at 12 firms
Original title: Unauthorized Codex and Claude Code Relays Disable Security Protections at 12 Organizations
A post-install script points the genuine CLIs at relay servers, swaps API keys, and sets danger-full-access; abuse has not been observed.
Symantec’s Threat Hunter Team says an unauthorized relay has hit 12 organizations since early 2026, mostly in mainland China. After a legitimate npm install of OpenAI Codex or Anthropic Claude Code, a fileless PowerShell or bash one-liner from lookalike domains rewrites config, sets relay base URLs and keys, and turns off sandboxing and telemetry. The tools are not vulnerable; they follow the altered settings. Victims span industrial automation, semiconductors, pharmaceuticals, shipping, and related sectors. Symantec found no evidence the operator is abusing the access.
Unconfirmed: Symantec says it found no evidence the operator is abusing its position; the risks are described as potential.
- The one-liner is fetched from domains such as vibe.aiok[.]me.
- Settings written include sandbox_mode “danger-full-access” and user-scope environment variables.
- Claude keys use the sk-ant-oat01- prefix, consistent with resold OAuth tokens.
- Some victims are Chinese operations of firms based in South Korea, Taiwan, and Malaysia.
Impact: Prompts, files, and secrets visible to the relay
- 1.Watch Codex and Claude configs for relay base URLs and danger-full-access.
- 2.Alert on iwr|iex or curl|bash immediately after the official global npm installs.
- 3.Flag CLI traffic to destinations outside the approved AI allow-list.
- ATT&CK
- T1059.001 PowerShellT1059.004 Unix ShellT1562.001 Disable or Modify ToolsT1204.002 Malicious File
- Products
- CodexClaude Code
- Organizations
- Symantec
- Countries
- ChinaSouth KoreaTaiwanMalaysia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aiok.me | ash) then runs, fetched from lookalike domains such as vibe.aiok[.]me. According to technical research published by Symantec , |
From the original article
2 min read at gbhackers.com
Symantec’s Threat Hunter Team has found an unauthorized relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs, then rewrites their settings to turn off sandboxing. It has affected 12 organizations since early 2026, mostly in mainland China. Codex Claude Code relays AI coding agents read files, write code, and run commands […]
By Kavichselvan · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.