AI relay disables security sandboxes in Codex and Claude Code

A shadowy AI relay service has been discovered distributing authentic but unauthorized OpenAI Codex and Anthropic Claude Code tools to overseas enterprise customers, with key security safeguards disabled. Symantec Threat Hunter Team says the relay installs legitimate CLIs for Codex and Claude Code on affected systems but then routes requests through the relay’s infrastructure instead of OpenAI’s or Anthropic’s networks.

Active since early 2026, the service has been observed on systems at about a dozen organisations, predominantly in mainland China and also in South Korea, Taiwan and Malaysia.

The relay’s configuration changes raise serious security concerns. Investigators found a suspicious PowerShell downloader described as an “AI-agent hijack” script, and note the CLIs are reconfigured to turn off execution sandboxes, enable network access for the write sandbox, switch off telemetry and error reporting, and replace the user’s API credentials with relay-issued tokens. In one instance the script logged a user out of an Anthropic session and reissued credentials controlled by the relay.

While no malware or malicious activity has yet been observed, Symantec warns that the architecture could facilitate credential theft, altered responses, or other abuses if the operators’ intentions change. The report emphasises that the relay can see every prompt, file and secret employees send to the agent and can fabricate or modify responses, given the sandbox is disabled and network access is enabled.