On Oct 29 Symantec's Threat Hunter Team disclosed an unauthorized AI relay seen at about a dozen organizations since early 2026, mostly in mainland China. Users install the genuine Codex or Claude Code CLI via npm, then run a one-line script from the reseller that rewrites ~/.codex/config.toml or ~/.claude/settings.json, points base_url at relay domains, swaps in relay-issued keys, sets the sandbox to danger-full-access and disables telemetry. Symantec says this is not a CLI vulnerability and it has seen no abuse so far.
Key Takeaways
- ✓About a dozen affected organizations, mostly in mainland China, plus Chinese or home-market units of South Korean, Taiwanese and Malaysian firms in semiconductors, electronics, pharma, shipping and petrochemicals
- ✓A one-line iwr | iex or curl | bash command fetches a fileless script from lookalike domains such as vibe.aiok[.]me, installs the genuine CLI, then rewrites its config, so it looks like a normal setup step
- ✓The Codex sandbox is set to danger-full-access with network access on, and DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1 are set
- ✓Relay-issued Claude Code keys use the sk-ant-oat01- prefix of subscription OAuth tokens, which Symantec says is consistent with, but not proof of, pooled subscription resale
- ✓Symantec says this is not a vulnerability in Codex or Claude Code and it has no evidence the operator has abused its access; the risks are potential
Key Decision Metrics at a Glance
Heavy Claude Code use: compare subscription limits and API bills
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background and pain point
OpenAI and Anthropic do not officially sell their coding agents in mainland China, so relay and shared-subscription services have sprung up to connect Codex or Claude Code to third-party servers. Many developers treat these as simple network proxies, but Symantec's report shows the relay's configuration goes much further than changing an address: the relay can see every prompt, file and secret, and can alter what comes back.
Architecture and mechanism
Users first run a normal npm install -g @openai/codex or @anthropic-ai/claude-code, then, minutes to about half an hour later, a one-line PowerShell or bash command supplied by the reseller. The fileless script rewrites ~/.codex/config.toml or ~/.claude/settings.json: base_url or ANTHROPIC_BASE_URL is pointed at a relay domain, the API key is replaced with a relay-issued token, and both are set as user-scope environment variables so they survive a reboot. Codex's sandbox_mode is set to danger-full-access, network access is enabled for the write sandbox, and telemetry and error reporting are turned off. On one host the script also ran claude /logout and deleted ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY before logging in again with relay credentials.
Benchmarks and comparisons
This is security research, so there are no benchmarks. The confirmed figures come from Symantec's post: about a dozen affected organizations since early 2026, and backend infrastructure rotated across at least eight domains, all impersonating OpenAI- or Anthropic-branded chat services. The report separates observed configuration changes from the potential risks that follow, and says there is no evidence yet of actual abuse.
What developers can do now
If you or your team have used a third-party relay, check base_url and sandbox_mode in ~/.codex/config.toml and ANTHROPIC_BASE_URL in ~/.claude/settings.json, then check whether user-scope variables such as OPENAI_BASE_URL, CODEX_API_KEY or ANTHROPIC_AUTH_TOKEN were changed. Security teams can watch for curl | bash or iwr | iex run right after an npm install of these CLIs, and allow-list outbound traffic from AI CLI tools. The report lists script hashes and domain IOCs that can be loaded into detection rules.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.