Grey-market relays reroute Codex and Claude Code traffic
Original title: Unauthorized OpenAI Codex and Claude Code Relays Disable AI Sandboxes and Redirect Enterprise Data
Symantec says lookalike-domain scripts disable sandboxes and send prompts, files and tokens through operator servers at about a dozen firms.
Symantec’s Threat Hunter Team says a grey-market relay has been active since at least early 2026 and has touched about a dozen organizations, mostly in mainland China, including local branches of firms based in South Korea, Taiwan and Malaysia. Employees install genuine OpenAI Codex or Anthropic Claude Code, then run a one-line command that fetches an in-memory setup script from domains such as vibe.aiok[.]me. The script points the tools at relay-controlled base URLs, stores the relay key as a user environment variable, sets sandbox mode to “danger-full-access,” enables network access and disables telemetry. Symantec says this is not a flaw in the tools and found no sign the operator has used the disabled sandbox to run commands.
Unconfirmed: The operator’s goal is unclear, and researchers could not say the logout-and-login step happens on every machine.
- Affected sectors include semiconductors, pharmaceuticals, shipping, petrochemicals and data centers.
- Claude Code keys issued by the relay start with sk-ant-oat01-, a subscription-login prefix.
- On one host the script ran claude /logout, deleted tokens and ran claude /login.
- Defenders are told to watch base_url, ANTHROPIC_BASE_URL and danger-full-access settings.
- Named relay domains include aiok[.]me, sorryios[.]io, nuoda[.]vip and claudechn[.]com.
Impact: Prompts, files and login tokens sent to relay servers
| Product | Affected |
|---|---|
| OpenAI Codex | — |
| Anthropic Claude Code | — |
- 1.Watch for base_url or ANTHROPIC_BASE_URL changes and sandbox_mode set to danger-full-access.
- 2.Look for OPENAI_BASE_URL, CODEX_API_KEY or ANTHROPIC_AUTH_TOKEN set as user-level variables.
- 3.Limit AI coding-tool traffic to an approved list of vendor endpoints.
- Products
- CodexClaude Code
- Organizations
- Symantec
- Countries
- ChinaSouth KoreaTaiwanMalaysia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aiok.me | t pulls a setup script from a lookalike domain such as vibe.aiok[.]me. The script runs in memory without saving a file, checks |
| domain | chat1.sorryios.chat | hat1[.]sorryios[.]io/codex Codex relay endpoint URL hxxps://chat1[.]sorryios[.]chat/claudecode Claude Code relay endpoint URL hxxps://chat[ |
| domain | chat1.sorryios.io | e/setup-claudecode.ps1 Claude Code setup script URL hxxps://chat1[.]sorryios[.]io Relay URL URL hxxps://chat1[.]sorryios[.]io/codex Codex |
| domain | chat.nuoda.vip | os[.]io Relay domain Domain nuoda[.]vip Relay domain Domain chat[.]nuoda[.]vip Relay domain Domain rawchat[.]cn Relay domain Domain sh |
| domain | chat.rawchat.cn | hxxps://rawchat[.]cn/codex Codex relay endpoint URL hxxps://chat[.]rawchat[.]cn/codex Codex relay endpoint URL hxxps://new[.]sharedchat |
| domain | claudechn.com | [.]cc Relay domain Domain mirbuds[.]com Relay domain Domain claudechn[.]com Relay domain Domain vibe[.]skk[.]moe Relay domain URL hxx |
| domain | gpt4.mirbuds.com | ew[.]sharedchat[.]cc/codex Codex relay endpoint URL hxxps://gpt4[.]mirbuds[.]com/codex Codex relay endpoint URL hxxps://claudechn[.]com/ |
| domain | mirbuds.com | ]cn Relay domain Domain sharedchat[.]cc Relay domain Domain mirbuds[.]com Relay domain Domain claudechn[.]com Relay domain Domain v |
| domain | new.sharedchat.cc | /chat[.]rawchat[.]cn/codex Codex relay endpoint URL hxxps://new[.]sharedchat[.]cc/codex Codex relay endpoint URL hxxps://gpt4[.]mirbuds[. |
| domain | nuoda.vip | [.]me Relay domain Domain sorryios[.]io Relay domain Domain nuoda[.]vip Relay domain Domain chat[.]nuoda[.]vip Relay domain Domai |
| domain | rawchat.cn | Relay domain Domain chat[.]nuoda[.]vip Relay domain Domain rawchat[.]cn Relay domain Domain sharedchat[.]cc Relay domain Domain m |
| domain | sharedchat.cc | [.]vip Relay domain Domain rawchat[.]cn Relay domain Domain sharedchat[.]cc Relay domain Domain mirbuds[.]com Relay domain Domain cla |
| domain | sorryios.io | aiok[.]me Relay domain Domain aiok[.]me Relay domain Domain sorryios[.]io Relay domain Domain nuoda[.]vip Relay domain Domain chat[ |
| domain | vibe.aiok.me | downloader posing as a Claude Code CLI setup script Domain vibe[.]aiok[.]me Relay domain Domain aiok[.]me Relay domain Domain sorry |
| domain | vibe.skk.moe | com Relay domain Domain claudechn[.]com Relay domain Domain vibe[.]skk[.]moe Relay domain URL hxxps://vibe[.]aiok[.]me Relay URL URL |
| sha256 | 2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24 | s of compromise (IoCs):- Type Indicator Description SHA-256 2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24 setup-codex.ps1, fileless PowerShell downloader posing as a |
| sha256 | 4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb | wnloader posing as an OpenAI Codex CLI setup script SHA-256 4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb setup-claudecode.ps1, fileless PowerShell/bash downloader p |
| url | https://chat1.sorryios.chat/claudecode | xxps://chat1[.]sorryios[.]io/codex Codex relay endpoint URL hxxps://chat1[.]sorryios[.]chat/claudecode Claude Code relay endpoint URL hxxps://chat[.]nuoda[.]v |
| url | https://chat1.sorryios.io | aiok[.]me/setup-claudecode.ps1 Claude Code setup script URL hxxps://chat1[.]sorryios[.]io Relay URL URL hxxps://chat1[.]sorryios[.]io/codex Codex |
| url | https://chat1.sorryios.io/codex | etup script URL hxxps://chat1[.]sorryios[.]io Relay URL URL hxxps://chat1[.]sorryios[.]io/codex Codex relay endpoint URL hxxps://chat1[.]sorryios[.]cha |
| url | https://chat.nuoda.vip | .]sorryios[.]chat/claudecode Claude Code relay endpoint URL hxxps://chat[.]nuoda[.]vip Relay URL URL hxxps://chat[.]nuoda[.]vip/codex Codex re |
| url | https://chat.nuoda.vip/claudecode | L hxxps://chat[.]nuoda[.]vip/codex Codex relay endpoint URL hxxps://chat[.]nuoda[.]vip/claudecode Claude Code relay endpoint URL hxxps://rawchat[.]cn/cod |
| url | https://chat.nuoda.vip/codex | relay endpoint URL hxxps://chat[.]nuoda[.]vip Relay URL URL hxxps://chat[.]nuoda[.]vip/codex Codex relay endpoint URL hxxps://chat[.]nuoda[.]vip/cla |
| url | https://chat.rawchat.cn/codex | int URL hxxps://rawchat[.]cn/codex Codex relay endpoint URL hxxps://chat[.]rawchat[.]cn/codex Codex relay endpoint URL hxxps://new[.]sharedchat[.]cc/ |
| url | https://claudechn.com/codex | hxxps://gpt4[.]mirbuds[.]com/codex Codex relay endpoint URL hxxps://claudechn[.]com/codex Codex relay endpoint Note: IP addresses and domains are i |
| url | https://gpt4.mirbuds.com/codex | xxps://new[.]sharedchat[.]cc/codex Codex relay endpoint URL hxxps://gpt4[.]mirbuds[.]com/codex Codex relay endpoint URL hxxps://claudechn[.]com/codex |
| url | https://new.sharedchat.cc/codex | hxxps://chat[.]rawchat[.]cn/codex Codex relay endpoint URL hxxps://new[.]sharedchat[.]cc/codex Codex relay endpoint URL hxxps://gpt4[.]mirbuds[.]com/c |
| url | https://rawchat.cn/codex | hat[.]nuoda[.]vip/claudecode Claude Code relay endpoint URL hxxps://rawchat[.]cn/codex Codex relay endpoint URL hxxps://chat[.]rawchat[.]cn/code |
| url | https://vibe.aiok.me | .]com Relay domain Domain vibe[.]skk[.]moe Relay domain URL hxxps://vibe[.]aiok[.]me Relay URL URL hxxps://vibe[.]aiok[.]me/setup-codex.ps1 |
| url | https://vibe.aiok.me/setup-claudecode.ps1 | s://vibe[.]aiok[.]me/setup-codex.ps1 Codex setup script URL hxxps://vibe[.]aiok[.]me/setup-claudecode.ps1 Claude Code setup script URL hxxps://chat1[.]sorryios[. |
| url | https://vibe.aiok.me/setup-codex.ps1 | moe Relay domain URL hxxps://vibe[.]aiok[.]me Relay URL URL hxxps://vibe[.]aiok[.]me/setup-codex.ps1 Codex setup script URL hxxps://vibe[.]aiok[.]me/setup-c |
From the original article
4 min read at cybersecuritynews.com
A grey market relay service is quietly installing the real OpenAI Codex and Anthropic Claude Code tools on company computers. It then changes their settings so that every prompt, file and login token goes through servers the service controls. The service has been active since at least early 2026 and has touched about a dozen […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.