Unauthorized AI relay service installs Codex and Claude Code CLIs with sandboxes disabled at 12 organizations, mostly in China

Linha do tempo

1. gbhackers.com ↗ · pub. 30/10/2026 12:23 · coletado 30/10 14:00

   Unauthorized Codex and Claude Code relay disables sandboxing and reroutes AI agent traffic at 12 organizations, mostly in China

   ler a análise desta fonte ocultar

   Symantec's Threat Hunter Team found an unauthorized relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs, then rewrites their configuration to disable sandboxing. It has affected 12 organizations since early 2026, mostly in mainland China. Victims span industrial automation, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals and data center services. Some are Chinese operations of firms based in South Korea, Taiwan and Malaysia. Most appear to be employees seeking a Western AI assistant not sold in their market, not chosen targets. Symantec found no evidence that the operator is abusing its position, so the risks are potential rather than observed.

   Technical Details

   • Users first run a legitimate npm install of Codex or Claude Code. A fileless PowerShell or bash one-liner (iwr | iex or curl | bash) then runs, fetched from lookalike domains such as vibe.aiok[.]me.
   • The script rewrites ~/.codex/config.toml or ~/.claude/settings.json. It points base_url or ANTHROPIC_BASE_URL at relay-controlled servers and swaps in relay-issued API keys, saved as user-scope environment variables that survive a reboot.
   • It sets sandbox_mode = "danger-full-access", enables network access for the write sandbox, and disables telemetry and error reporting.
   • On one host it ran claude /logout, deleted the Anthropic authentication variables and forced a fresh login. Several hosts also queried the Windows geo setting, likely to confirm the system was in the region the relay serves.
   • This is not a vulnerability in Codex or Claude Code. The tools behave as designed once their configuration is changed.
   • Potential risks: the relay sees every prompt, file and secret sent to the agent. It can alter or fabricate responses, and with the sandbox off and network access on, a malicious response could run with the user's full privileges. Other tools on the same machine can read the credentials stored in user-scope environment variables.
   • The Claude keys use the sk-ant-oat01- prefix, which Anthropic uses for subscription OAuth tokens, consistent with pooled flat-rate subscriptions being resold.

   Remediation

   • Monitor endpoints running these CLIs for changes to base_url or ANTHROPIC_BASE_URL, the presence of danger-full-access in config.toml, and OPENAI_BASE_URL, CODEX_API_KEY or ANTHROPIC_AUTH_TOKEN set outside approved deployment.
   • Alert on iwr | iex or curl | bash run right after npm install -g @openai/codex or @anthropic-ai/claude-code.
   • Alert on CLI traffic to destinations outside an approved AI allow-list.
2. darkreading.com ↗ · pub. 29/10/2026 07:00 · coletado 29/10 08:00 primeiro registro

   Unauthorized AI relay service installs OpenAI Codex and Claude Code CLIs with sandboxes disabled in APAC enterprises

   ler a análise desta fonte ocultar

   Symantec's Threat Hunter Team has uncovered a mysterious AI relay service, active since early 2026, that installs genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems in regions where these tools are not officially sold. The service, observed at roughly a dozen organizations in mainland China, South Korea, Taiwan and Malaysia, reroutes all agent traffic through its own infrastructure and strips out key security controls. No malware or malicious activity has been observed yet, but the architecture gives the operator full visibility into every prompt, file and secret, plus the ability to alter responses. With the execution sandbox disabled and network access enabled, a malicious response could execute with the full privileges of the user's account. Symantec frames the affected organizations as victims of employee-driven shadow AI rather than targeted intrusion.

   Technical Details

   Investigators first flagged a suspicious PowerShell downloader later characterized as an "AI-agent hijack script." When a user installs a legitimate Codex or Claude Code CLI via npm, a fileless PowerShell or bash script is fetched from a lookalike domain via a one-line command the user appears to run themselves — reminiscent of ClickFix/InstallFix patterns, though the CLI binaries themselves are not trojanized. The script disables the CLI execution sandbox, enables network access for the write sandbox, turns off telemetry and error reporting, and replaces the user's API credentials with relay-issued tokens that persist across reboots. In one case the script logged the user out of their Anthropic session and deleted authentication variables before reissuing relay-controlled credentials. Issued Claude Code keys carry the prefix Anthropic reserves for subscription-based OAuth tokens, consistent with a relay pooling flat-rate subscriptions across many customers.

   Remediation

   Symantec published indicators of compromise despite no confirmed compromise. Defenders should hunt for one-line installer commands pulling scripts from lookalike domains, audit Codex/Claude Code configuration for disabled sandboxes and altered API endpoints, monitor for unexpected logouts or credential replacement in AI tooling, and enforce policy against unsanctioned shadow AI services.