Unauthorized AI relay disables Codex and Claude Code sandboxes
Original title: Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes
Symantec says the relay has installed genuine CLIs at a dozen organizations, mostly in mainland China, since early 2026.
Symantec's Threat Hunter Team found a relay that installs genuine OpenAI Codex and Anthropic Claude Code command-line tools on enterprise systems and routes requests through its own infrastructure instead of the vendors' networks. The service also disables security safeguards. It has been active since early 2026 at a dozen organizations, mainly in mainland China and also in South Korea, Taiwan, and Malaysia. No malware or malicious activity has been observed, and researchers say it is unclear why the safeguards are turned off.
Unconfirmed: Symantec has not established why safeguards are disabled, and no malicious activity has been observed.
- A suspicious PowerShell downloader was later described as an AI-agent hijack script.
- Installations were found mainly in mainland China, plus South Korea, Taiwan, and Malaysia.
- Symantec says no malware or malicious activity has been observed so far.
- The service has been active since early 2026.
Impact: Security safeguards on coding-agent CLIs are disabled
| Product | Affected |
|---|---|
| OpenAI Codex | — |
| Anthropic Claude Code | — |
- 1.Review enterprise systems for Codex or Claude Code CLIs routed through an unauthorized relay.
- Products
- CodexClaude Code
- Organizations
- Symantec
- Countries
- ChinaSouth KoreaTaiwanMalaysia
From the original article
8 min read at darkreading.com
The enigmatic service is providing popular AI coding tools to mainland China and other regions where OpenAI and Anthropic products are not officially for sale — but with key security features turned off.
By Rob Wright · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.