Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Relay routes genuine Codex and Claude Code CLIs, disables sandboxes

3 sources · 3 articlesFirst reported Updated ()1
What's new

October 30: GBHackers specifies 12 organizations, a fileless PowerShell or bash one-liner after a legitimate npm install, and industrial automation among affected sectors.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Symantec says a grey-market relay has pointed genuine Codex and Claude Code CLIs at its servers and disabled sandboxes at about a dozen firms since early 2026, with no observed abuse.

Symantec’s Threat Hunter Team says an unauthorized relay has been active since early 2026 at about a dozen organizations, mostly in mainland China. Employees install genuine OpenAI Codex or Anthropic Claude Code, then a fileless one-line script points the tools at relay servers, swaps in relay keys, enables “danger-full-access” and network access, and turns off telemetry. Symantec says the tools are not flawed and has seen no malware or operator abuse of the disabled sandbox. Dark Reading also places activity in South Korea, Taiwan, and Malaysia; Cyber Security News and GBHackers say those are Chinese operations of firms based there.

Key facts
  • Activity dates to early 2026 at about a dozen organizations, mostly in mainland China.
  • A post-install one-liner sets relay base URLs, keys, and sandbox_mode “danger-full-access.”
  • Claude relay keys use the sk-ant-oat01- prefix, described as resold OAuth tokens.
  • Sectors include semiconductors, pharmaceuticals, shipping, petrochemicals, data centers, and industrial automation.
  • Symantec reports no malware and no observed operator commands through the disabled sandbox.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Dark ReadingPlaces activity in South Korea, Taiwan, and Malaysia, not only Chinese branches.
  • Cyber Security NewsNames relay domains, key prefix, logout-login on one host, and defender checks.
  • GBHackersExact count of 12, npm install, bash one-liner, and industrial automation.
Vendors
OpenAIAnthropic
Products
CodexClaude Code
Organizations
Symantec
Countries
ChinaSouth KoreaTaiwanMalaysia

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Dark ReadingFirst report

    Unauthorized AI relay disables Codex and Claude Code sandboxes

    Symantec says the relay has installed genuine CLIs at a dozen organizations, mostly in mainland China, since early 2026.

  2. · 10h ago Cyber Security News

    Grey-market relays reroute Codex and Claude Code traffic

    Symantec says lookalike-domain scripts disable sandboxes and send prompts, files and tokens through operator servers at about a dozen firms.

  3. · 3h ago GBHackers

    Unauthorized relays disable Codex and Claude Code sandboxes at 12 firms

    A post-install script points the genuine CLIs at relay servers, swaps API keys, and sets danger-full-access; abuse has not been observed.