Unauthorized Relays Rewire Codex and Claude Code CLIs, Symantec Reports

Symantec’s Threat Hunter Team has described a relay service that hands developers access to OpenAI’s Codex and Anthropic’s Claude Code, then quietly sits between them and the vendors. The report is dated 29 October 2026. It says the service has been active since at least early 2026.

Symantec is blunt about the framing: “This is not a vulnerability in Codex or Claude Code.” The problem is what gets installed around the genuine tools.

How the relay works

The service doesn’t ship its own client. Users paste a one-line PowerShell or bash command from a lookalike domain, and the script installs Node and the CLI itself if they are missing. Symantec saw the command run from within minutes to roughly half an hour after an install. It did not observe automated or exploit-based delivery, and it infers from the script’s design that users run the command themselves; it has not seen the page or message the command was copied from.

The setup script then changes the configuration. According to Symantec, it:

• sets Codex’s sandbox to “danger-full-access”, enables network access for the write sandbox;
• replaces the CLI’s base URL with a relay-controlled domain, substitutes relay-issued API keys stored as user-scope environment variables so they survive reboots, and sets DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1 (Symantec does not say which CLI each setting targets);
• on one host, logged the user out of their Anthropic session and deleted existing authentication variables before installing its own. Symantec says it was not established whether this step runs in every deployment.

Some hosts also queried the Windows locale setting after installation. Symantec’s interpretation is that this is “consistent with a service confirming it is running on a system in the region it serves before completing setup.”

Who is affected

Symantec describes about a dozen organizations, mostly in mainland China, where the vendors don’t officially operate. It also names Chinese operations and some home-market operations of multinational firms in South Korea, Taiwan and Malaysia. Sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals and data center services. The relay’s backend has rotated across at least eight registered domains.

What’s actually at risk

Nothing here shows the operator doing harm. Symantec says there is “no evidence so far that the relay operator has abused this level of access.” It lists possible motives, including getting around regional restrictions, reselling discounted capacity and fraud, and says none is confirmed. It adds that the sk-ant-oat01- key prefix is “consistent with, though not proof of” a relay pooling flat-rate subscriptions.

The exposure is structural. Every prompt, file the agent reads and secret in its context passes through a server the organization doesn’t control. With the sandbox off and network access on, Symantec warns that a malicious or compromised response could execute with the user’s full privileges; it describes these risks as potential. The relay-issued keys sit in user-scope environment variables, where other tools on the same machine can read them. On our reading, the sandbox change matters most: it removes the guardrail the vendor intended, and it does so in an ordinary config file.

This is one vendor’s report. We found no independent corroboration as of 5 November 2026; other outlets republish Symantec’s findings, and we have no statement from OpenAI or Anthropic.

What defenders can check

Symantec’s recommendations translate into a short hunt list:

• Changed base_url or ANTHROPIC_BASE_URL values in CLI configuration.
• sandbox_mode set to danger-full-access in ~/.codex/config.toml.
• User-scope environment variables such as OPENAI_BASE_URL, CODEX_API_KEY or ANTHROPIC_AUTH_TOKEN set outside approved deployment processes.
• PowerShell iwr | iex or bash curl | bash commands run close to an npm install of either CLI.
• Traffic from AI CLI tools to destinations not on an approved allow-list.

Symantec publishes file hashes for two scripts, setup-codex.ps1 and setup-claudecode.ps1, and ten domain entries (eight registered domains) in its report. We haven’t reproduced them here; take them from the original.

Symantec says: “If an IOC is malicious and the file is available to us, Symantec Endpoint products will detect and block that file.”

The broader pattern

Teams that can’t get official access to a coding agent will find unofficial access, and the unofficial route is a man in the middle by design. Our assessment is that the fix is as much procurement as detection: provide an approved route, pin the base URL and sandbox mode where the vendor supports managed configuration (Adversa notes Anthropic’s managed settings bind Claude Code only and can be edited by a developer with local admin rights), and treat an unexpected endpoint in an agent’s config as a security finding.

References

• Symantec Threat Hunter Team — Unauthorized OpenAI and Claude relays
• Adversa AI — AI coding agent security resources, November 2026