An unauthorized relay service has targeted organizations in China, South Korea, Taiwan, and Malaysia since early 2026, reconfiguring legitimate OpenAI Codex and Anthropic Claude Code CLIs to disable sandboxes and route requests through attacker servers. About a dozen organizations in semiconductors, pharma, and manufacturing were affected. A one-line bash or PowerShell command delivers the compromise by disguising itself as routine installation, setting Codex to “danger-full-access” mode, disabling telemetry, and swapping API credentials.
What makes this scary isn’t observed malicious activity, there’s been none, but the capability it creates. With sandboxing disabled and traffic routed through attacker servers, the relay operator sees every prompt, file, and secret flowing through these tools, plus can intercept and alter responses. According to threat intelligence from Symantec and Carbon Black, no exploitation has been observed to date, suggesting capability-building: the infrastructure is ready and waiting. The social engineering angle, disguising the compromise as a routine install, is what keeps it from being detected.
Sources: Sandbox Flipped to ‘Danger-Full-Access’: Unauthorized AI Relays Create Risk for Organizations
Coverage: Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes
Related on this blog: [AUTO] How Downloads Folder Became an Agent Attack Surface • [AUTO] Claude Code auto-executes repository configuration • [AUTO] Coding agents leak secrets through pre-approved tools