al-ice.ai

Danger-Full-Access by Default: Unauthorized Relays Strip Sandboxes From Codex and Claude Code at 12 Organizations

Agent & Supply Chain Security by al-ice.ai Editorial

The most insidious supply-chain compromise is the one that installs the genuine software. In a 29 October 2026 report, Symantec’s Threat Hunter Team describes an unauthorized relay service, active since at least early 2026, that installs the real OpenAI Codex and Anthropic Claude Code command-line agents on enterprise machines — then rewrites their configuration so that every prompt, file, and secret flows through third-party servers with the execution sandbox switched off. The team observed the relay in use at a dozen organizations, most in mainland China plus multinational subsidiaries in South Korea, Taiwan, and Malaysia, spanning industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data-center services. Symantec is explicit that this is not a vulnerability in either CLI: once the configuration is changed, the tools behave exactly as designed. The compromise is the configuration itself.

The delivery is what makes this a shadow-AI story rather than a malware story. There is no trojanized binary and no exploit. Users run a legitimate npm install -g @openai/codex or @anthropic-ai/claude-code, and within minutes — at most about half an hour — paste a one-line command that fetches a fileless PowerShell or bash setup script from a lookalike domain such as vibe.aiok[.]me. The script prints progress messages in Chinese, asks to be re-run elevated if it lacks administrator rights, installs Node.js or the CLI silently if missing, and only then applies its own configuration: base_url / ANTHROPIC_BASE_URL pointed at relay infrastructure, a relay-issued API key swapped in, and both established as user-scope environment variables so the change survives reboots. Along the way it sets Codex to sandbox_mode = “danger-full-access”, enables network access for the write sandbox, and sets DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1 — silencing exactly the signals that might otherwise reach OpenAI or Anthropic. On at least one host the script went further, running claude /logout, deleting ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY, and re-running login — clearing a legitimate authenticated session so it could not override the relay’s credentials. Several hosts also show a geolocation check against the Windows Geo Nation key, consistent with a service confirming it is running in the region it serves.

A relay that sees everything and constrains nothing

Symantec found the backend rotating across at least eight impersonator domains — chat[.]nuoda[.]vip, rawchat[.]cn, sharedchat[.]cc, claudechn[.]com among them — and published file hashes for the two setup scripts. On motive, the team is candid that the evidence does not settle it: bypassing regional restrictions on Western coding agents is the simplest explanation for mainland-China demand, but that alone does not require disabling sandboxes or persisting credentials. The relay-issued Claude Code keys carry the formatting of subscription-based OAuth tokens rather than pay-per-use API keys, which is consistent with — though not proof of — pooling flat-rate subscriptions and reselling the capacity. Fraud with stolen payment instruments and resale of the prompts and files passing through the relay cannot be ruled out either. What is settled is the exposure: a relay in this position reads every prompt and file the employee sends the agent, can alter or fabricate every response, and — with the sandbox off and network on — a malicious or compromised response executes with the user’s full privileges. And because the credentials live in user-scope environment variables, any other tool on the box that reads the environment picks them up too, spreading the blast radius beyond the coding assistant. Symantec reports no evidence the operator is currently abusing the position — every risk above is potential, not observed — but notes the architecture would fully support abuse if the operator’s intentions or security changed.

Shadow AI with a setup script

This belongs in the same incident family as the recent trojanized Claude Code build on Cursor’s marketplace and the fake ChatGPT and Claude builds with signed-binary sideloading — except the artifact here is legitimate, which makes it harder to catch and easier to rationalize. The affected organizations look less like chosen targets and more like workplaces where employees wanted Western coding agents that are not officially sold in their market and turned to an unauthorized reseller. That demand-side framing should worry defenders more than a targeted campaign would: it means the installer ran with the user’s consent, with admin rights, past endpoint tooling that saw a routine npm workflow. It also pairs grimly with the week’s other sandbox news — the embedded-browser flaws across five AI assistants and the personal agent that lived two months on a defense network — all of them cases where the agent’s containment boundary was the thing that failed or was never there. Detection guidance from Symantec is refreshingly concrete: watch for base_url changes in CLI configs, danger-full-access in ~/.codex/config.toml, relay credentials in user-scope environment variables outside approved deployments, one-line downloader invocations trailing npm installs, and CLI traffic to anything outside your allow-listed AI endpoints.

What to do

  • Allow-list AI service endpoints at the egress. CLI traffic to anything outside vendor and approved-gateway domains is the highest-signal detector for this class — the relay cannot function without its base_url override phoning home.
  • Alert on sandbox downgrades. Treat sandbox_mode = danger-full-access, network-enabled write sandboxes, and DISABLE_TELEMETRY / DISABLE_ERROR_REPORTING in agent configs as compromise indicators, not preferences.
  • Audit environment-scoped credentials. Hunt for OPENAI_BASE_URL, CODEX_API_KEY, and ANTHROPIC_AUTH_TOKEN set as persistent user-scope variables outside your approved deployment process; rotate anything that touched a relay.
  • Give sanctioned paths for restricted regions. Employees sourced this relay because the legitimate tool was unavailable to them. Subsidiaries and contractors in unserved markets need an approved route to coding agents or they will find their own.

Sources: