Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes

The enigmatic service is providing popular AI coding tools to mainland China and other regions where OpenAI and Anthropic products are not officially for sale — but with key security features turned off.

A mysterious relay service is installing authentic but unauthorized OpenAI Codex and Anthropic Claude Code tools for enterprise users overseas, and making dangerous configuration changes that put those organizations at risk.

The AI relay, first spotted by the Symantec Threat Hunter Team, appears to be designed to bypass regional restrictions that prevent certain countries and regions from using AI tools and platforms of US companies. According to Symantec’s report published Thursday, the relay service installs genuine versions of the command-line interfaces (CLIs) for Codex and Claude Code on enterprise systems, but reconfigures them to route requests through the relay’s infrastructure rather than OpenAI’s or Anthropic’s networks.

On the surface, this appears to be the case of a gray market provider or unauthorized reseller providing the AI tools to markets where they are not officially sold. Symantec researchers noted that the service, which has been active since early 2026, has installed the tools on systems at a dozen organizations, primarily in mainland China but also in South Korea, Taiwan, and Malaysia.

But the relay service also disables security safeguards for the tools, and the research team said it’s unclear why it’s being done (no malware or malicious activity has been observed thus far). One thing is for certain, according to Symantec: the relay service is creating enormous cyber-risk for the organizations using it.

Dangerous Configurations for Codex, Claude Code Users

Brigid O Gorman, senior intelligence analyst at the Symantec Threat Hunter Team, tells Dark Reading that researchers found a suspicious PowerShell downloader that they later determined to be “an AI-agent hijack script.” After investigating further, the team found similar activity on other networks and traced it to the unauthorized relay service.

According to Symantec’s report, when a user of the AI relay installs a legitimate Codex or Claude Code CLI through npm, the fileless PowerShell or bash script is fetched from “a lookalike domain by a one-line command that the user appears to run themselves. While this evokes the specter of attack techniques like ClickFix and InstallFix, the research team noted that the CLI clients aren’t modified or Trojanized in any way.

And yet, the tools perform suspicious actions that heighten risks for enterprises. For example, the reconfigurations turn off the CLIs’ execution sandbox, which is a key security feature because it limits what the AI coding tools can do.

Additionally, the relay service enables network access for the write sandbox, turns off telemetry and error reporting features, and replaces the user’s API credentials with relay-issued tokens. In one case observed by the Symantec Threat Hunter Team, the script logged a user out of their Anthropic session and deleted their authentication variables before reissuing credentials controlled by the relay service.

“Bypassing the regional restrictions that keep Western AI vendors from selling directly into certain markets is the simplest explanation, but it does not require disabling a CLI’s sandbox or establishing persistent credentials that survive a reboot,” the report stated.

Grave Risks for Gray Market Users

The relay service activity is something of an enigma. The Symantec Threat Hunter Team said it’s unclear why the operators of the client-side relay would need this level of control over users’ systems, though the researchers did not observe any evidence of the operators abusing the access. The report noted that the architecture of the service would support malicious exploitation of the access if the operator’s intentions were to change.

Furthermore, the Claude Code keys issued by the relay service are formatted with the prefix that Anthropic reserves for subscription-based OAuth tokens, “which is consistent with, though not proof of, a relay pooling flat-rate subscriptions and splitting the capacity across many customers,” the team wrote.

On the other hand, disabling security features hints at a potential fraud operation involving stolen credentials or payments cards, or even the malicious resale of prompts and files that run through the relay infrastructure. Gorman says it’s “certainly notable” that the relay disables execution sandboxes and establishes its own persistent credentials.

“We did not see any malicious activity being carried out using these relay services, so any commentary on the potential intended goals of those using it are speculative,” Gorman says. “However, a relay in this position can see every prompt, file, and secret an employee sends to the agent, and can alter or fabricate every response it returns. With the sandbox disabled and network access enabled, a malicious or compromised response could execute with the full privileges of the user’s account.”

Symantec provided indicators of compromise (IoCs) in the report, even though technically speaking there have been no compromises at this stage. “The organizations affected here look less like chosen targets and more like workplaces where individual employees found and used such a service to get access to tools they wanted,” the report stated.

Nevertheless, the research team warned that using the service presents serious risk to corporate networks. And while the relay appears to be aimed at regions where Codex and Claude Code tools aren’t officially offered, organizations looking for cheaper alternatives and users engaging in shadow AI activity could potentially find their way to such a service.