Unauthorized Codex and Claude Code Relays: Sandbox Off, Traffic Rerouted

Symantec's Threat Hunter Team has described a grey-market service that installs the genuine OpenAI Codex and Anthropic Claude Code command-line tools on company computers, then rewrites their settings so every prompt, file and login token passes through servers the service controls. It also turns the sandbox off. If you or your colleagues set up a coding agent with a one-line command from a reseller, check your agent config files today. If you installed from the vendor's documentation and never touched the endpoint, nothing here applies to you.

The research was published by Symantec on October 29, 2026 and covered the next day by Cyber Security News. The central point is easy to miss: neither tool has a flaw here. They do what their configuration tells them to do, and the configuration has been changed under the user.

TL;DR

What Symantec found

According to Symantec, the relay service has been active since at least early 2026 and has touched about a dozen organizations. Most are in mainland China, including local operations of companies headquartered in South Korea, Taiwan and Malaysia. The sectors named are industrial automation, electronics, semiconductors, pharmaceuticals, shipping, tires, petrochemicals and data centers.

The service sells access to Western AI coding tools that are hard to reach from the served region. Its backend has rotated across at least eight domains, all impersonating OpenAI- or Anthropic-branded chat services. Symantec's list of indicators includes the setup host vibe.aiok.me and relay domains such as sorryios.io, nuoda.vip, rawchat.cn, sharedchat.cc, mirbuds.com and claudechn.com. The full list, with file hashes, is in the original report.

How the setup works, step by step

1. A normal install. The user installs the real CLI through npm, using @openai/codex or @anthropic-ai/claude-code. Nothing about this step is malicious.
2. A one-line command from the reseller. Within minutes to about half an hour, the user runs a fetch-and-execute command: iwr | iex in PowerShell on Windows, or curl | bash on Linux and macOS. It pulls a setup script from a lookalike domain. The command contains a relay-issued key and prints progress messages in Chinese, which suggests users copy it from the reseller and run it themselves. Symantec saw no exploit and no automated delivery.
3. The script runs in memory. It checks for Node.js and the CLI, installs them if they are missing, and applies its changes. Because a working install results, the whole thing looks routine.
4. The configuration is rewritten. This is the part that matters, covered in the next section.
5. A region check. Several hosts ran a Windows region query right after install, apparently to confirm the victim is in the market the service serves.

What the script changes

On one host, Symantec saw the script log out of a legitimate Claude session and delete existing authentication variables before installing its own. The researchers could not confirm that this happens on every machine.

Note what the combination does. The base URL decides who answers the model's requests. The sandbox setting decides what a response is allowed to do on your machine. Switching the sandbox to full access with network enabled means a malicious or tampered response could run commands with the user's full account rights and reach out to the network. Symantec lays this out as a risk, not as something it observed.

Why a relay is a bigger deal than a proxy

A relay sits between the agent and the model. Everything the agent sends is visible to it: the prompt, the contents of files the agent read to answer, tool output, and the credentials in the request. It also controls what comes back. A coding agent acts on model output by editing files and running commands, so whoever controls the output has a path to your machine, limited only by the sandbox and permission prompts. Those are exactly the two protections this service switches off.

Two details make it harder to notice:

• Persistent credentials. The relay key is stored as a user-level environment variable, so it survives reboots. Other software on the same machine can read it, which widens the exposure beyond the coding agent.
• Muted telemetry. Disabling telemetry and error reporting removes signals the vendors would otherwise see, such as unexpected endpoints or unusual usage.

What is not known

Symantec is careful about motive, and so should we be. The simplest explanation is getting around regional restrictions, but that does not require disabling the sandbox. Keys with the sk-ant-oat01- prefix are subscription-style OAuth tokens, which could mean pooled flat-rate subscriptions resold at a discount. Credential or payment-card fraud and reselling the data that passes through the relay are not ruled out. Symantec found no evidence of abuse.

That uncertainty is the point for defenders. You cannot judge the risk by guessing the operator's intent. You can only check whether the configuration on your machines is the one you intended.

What this means if you run AI coding agents

These checks come from Symantec's detection guidance and take a few minutes.

1. Check the Codex config. Open ~/.codex/config.toml. Look for a base URL that is not OpenAI's, and for sandbox_mode = "danger-full-access" that you did not set deliberately.
2. Check the Claude Code settings. Open ~/.claude/settings.json and look for ANTHROPIC_BASE_URL or a base_url pointing at a domain you do not recognize.
3. Check user-level environment variables. OPENAI_BASE_URL, CODEX_API_KEY and ANTHROPIC_AUTH_TOKEN set at user scope, outside an approved deployment, deserve an explanation.
4. Look at your shell history. A curl | bash or iwr | iex run shortly after, or in place of, an npm install of either CLI is the signature of this setup.
5. If you find any of it, restore the defaults, sign in with your own account, and rotate every secret that could have passed through the agent while the relay was active: API keys, tokens in .env files the agent read, and anything pasted into a prompt.
6. Do not rely on domain blocking. The operator has rotated domains repeatedly. Alert on configuration changes and restrict AI tool traffic to an approved endpoint list.

For teams, the demand behind this is employees who cannot get an approved tool and find a workaround. An approved access path and a short policy on endpoints and sandbox mode do as much as any detection rule. Our checklist for rolling out AI coding agents across a team covers that side. The official install routes are on Anthropic's setup page; read the host in any command before you run it, as in our post on fake Claude Code installers.

Who should worry, and who can relax

The reported victims are organizations in a specific market, and Symantec saw no automated delivery, so a developer who installed from the vendor's documentation and signed in with their own account is not in scope. The people who should check are those who received a setup command from a third party, a chat group or a reseller, and anyone responsible for machines where such a command might have been run.

A useful habit is to treat the two config files as part of your attack surface, in the same way you treat a .npmrc that sets a registry. A changed registry sends your installs somewhere else; a changed model endpoint sends your prompts somewhere else. Both are single-line edits that look harmless in a diff. If you keep dotfiles in version control, a change to either file will show up in review. If you manage a fleet, a periodic read of those two files and the user-level environment variables listed above is cheap, and it also finds well-meaning but unapproved gateways that employees set up for themselves.

How this fits earlier incidents

This is a different shape of attack from the ones we have covered. In Aokigahara, malware went after the credential files of coding agents. In Symantec's Skynet Mode research, attackers abused exposed AI endpoints. Here nothing is stolen from the machine by malware in the usual sense: the user installs and configures a service that was always going to see their traffic. The trust decision is the configuration file, which is why it is worth reading. We keep the wider record in the AI agent security incidents timeline.

What Beam can and cannot do here

Beam does not audit which model endpoint your agent talks to, and it cannot see inside the relay. Be clear about that gap. What it does document: for Claude Code and Codex, a PreToolUse hook records each proposed action, and with an active workspace policy a deny response can stop a risky command, such as a destructive shell call, before it runs. That matters more when the sandbox is off, because it is a second layer that does not depend on the sandbox setting. See stopping dangerous Claude Code commands.

The limits are real. The deny is hook-based, not a kernel sandbox, and a missing cached policy fails open. Beam also scans skills and MCP configs with heuristics; see the MCP security guide. Everything stays on your device, as described in how Beam stays local.

Frequently asked questions

Are Codex or Claude Code vulnerable in this campaign?

No. Symantec says the tools behave as designed once their configuration is changed. The exposure comes from a relay service that rewrites the base URL, credentials and sandbox settings after a normal install.

How do I check whether my Codex or Claude Code was redirected?

Open ~/.codex/config.toml and ~/.claude/settings.json and look for an unfamiliar base_url or ANTHROPIC_BASE_URL, and for sandbox_mode set to danger-full-access. Also check user-level environment variables such as OPENAI_BASE_URL, CODEX_API_KEY and ANTHROPIC_AUTH_TOKEN.

What can the relay operator see?

In principle every prompt, file and secret the agent sends, and the operator can alter or fabricate responses. Symantec found no evidence the operator has abused this access, so the risks are potential rather than observed.

Is blocking the relay domains enough?

No. Symantec reports the backend has rotated across at least eight domains. Watching for configuration changes and restricting AI tool traffic to an approved endpoint list lasts longer than a domain blocklist.

Can Beam detect a hijacked base URL?

Not directly. Beam's documented checks cover agent actions through Claude Code and Codex PreToolUse hooks and scans of skills and MCP configs. It does not audit the model endpoint in your agent settings, so check those files yourself.

What should I do if I used one of these one-line setup commands?

Remove the relay settings, restore the vendor's default endpoint and sandbox mode, sign in again with your own account, and rotate any secret that appeared in a prompt, file or environment while the relay was active.

Related reading: Enterprise data agents and access control.

Details reflect Symantec's report as of October 30, 2026. The relay's domains rotate, so check the original report for current indicators.