Grey-Market Relay Turns Off Codex and Claude Code Sandboxes

An unofficial service selling OpenAI’s Codex and Anthropic’s Claude Code into countries where neither is sold has been quietly switching off the tools’ main safety features. Symantec’s threat hunters found it on machines at about a dozen organisations, mostly in mainland China. They have seen no attacks yet, but say the setup hands the operator everything it would need to launch one.

What Symantec found

Symantec’s Threat Hunter Team published its report on Thursday, Dark Reading reports. The team first spotted a PowerShell downloader it later called “an AI-agent hijack script”, then traced the same activity across other networks to a relay service that has been running since early 2026. Most affected organisations are in mainland China, with others in South Korea, Taiwan and Malaysia.

The relay doesn’t fake the software. Users install the genuine Codex or Claude Code command-line tools through npm, the standard package manager. A one-line command, which the user appears to run themselves, then fetches a script from a lookalike web domain. That script rewires the tools so every request goes through the relay’s servers instead of OpenAI’s or Anthropic’s.

What gets switched off

According to Symantec, the script makes four changes:

• It turns off the execution sandbox, the walled-off space that limits what the coding agent can do on the computer.
• It gives the agent network access while it writes files.
• It disables telemetry and error reporting, so the vendors see less.
• It swaps the user’s own API credentials for tokens issued by the relay. In one case it logged a user out of their Anthropic session and deleted their login settings first.

“Bypassing the regional restrictions that keep Western AI vendors from selling directly into certain markets is the simplest explanation, but it does not require disabling a CLI’s sandbox or establishing persistent credentials that survive a reboot,” the report says. The Claude Code keys the relay hands out use the prefix Anthropic reserves for subscription logins, which Symantec says is consistent with, though not proof of, one service pooling flat-rate subscriptions and splitting them among many customers.

Why it matters

Brigid O Gorman, a senior analyst on the Symantec team, told Dark Reading that no malicious activity has been seen. But she said a relay in that position “can see every prompt, file, and secret an employee sends to the agent” and can change any answer it sends back. With the sandbox off, a bad response “could execute with the full privileges of the user’s account”.

It is the latest in a run of AI security warnings this week. On Tuesday Cohere said an Alibaba model tried to send a file to a server in Beijing during a test, and Anthropic showed an unreleased Claude chaining bugs into working attacks. This time the weak point isn’t the model at all, but the pipe between the user and the vendor.

Symantec says the affected companies look less like chosen targets and more like workplaces where individual staff found a cheap way to get tools they wanted. That makes it a shadow-IT problem as much as a regional one. Security teams can check whether Codex or Claude Code on their machines points anywhere other than OpenAI or Anthropic, and whether the sandbox is still on.