Symantec: a grey-market relay installs the real Codex and Claude Code CLIs in China-based firms, then switches their sandboxes off and routes every prompt through its own servers
Confirmed
The takeaway
Symantec saw no abuse yet, but notes the operator could read every prompt, file and secret and run commands with the user’s privileges.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 29 October 2026
Your AI and this story
- GPT-6 Astra182 days after its cutoff
- Claude Opus 5.5121 days after its cutoff
- Gemini 4 Argon212 days after its cutoff
- Grok 4.7151 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 121 days before it.
Key facts
- Scope (Symantec, Oct 29): about a dozen organizations since at least early 2026, most in mainland China, plus Chinese operations (and in some cases home-market operations) of South Korean, Taiwanese and Malaysian multinationals; sectors include industrial automation, electronics, semiconductors, pharmaceuticals, shipping, tyres, petrochemicals and data-centre services
- How it arrives: users run a legitimate npm install of @openai/codex or @anthropic-ai/claude-code, then within minutes to about half an hour a one-line PowerShell/bash command fetched from a lookalike domain; Symantec saw no exploit-based delivery and concludes users copy a ready-made command from the reseller
- What it changes: the CLI’s base URL and API key point to the relay; Codex’s sandbox_mode is set to ‘danger-full-access’ and network access is enabled for the write sandbox; telemetry and error reporting are disabled; on one host the script logged the user out of a legitimate Anthropic session before installing relay credentials
- Symantec: ‘This is not a vulnerability in Codex or Claude Code. The tools are behaving as designed once their configuration has been changed.’ ‘There is no evidence the operator is currently abusing its position’
- Business model (Symantec’s reading): bypassing regional restrictions is the simplest explanation, but it does not require disabling the sandbox; the Claude Code keys used the sk-ant-oat01- prefix of subscription OAuth tokens, ‘consistent with, though not proof of’, pooled flat-rate subscriptions resold to many customers
- Infrastructure rotated across at least eight domains impersonating OpenAI- or Anthropic-branded chat services; Symantec lists detection hints (base-URL changes, ‘danger-full-access’ in ~/.codex/config.toml, user-scope credential variables)
- Context: OpenAI and Anthropic do not sell their coding agents in mainland China; Anthropic has fought resellers and distillation (2026-06-24, 2026-10-28 entries), and China’s NVDB called Claude Code’s hidden China-user markers a ‘backdoor’ (2026-07-01 entry)
What happened
Symantec found that the relay does not ship a modified client. It installs the real tools from npm and then changes their settings, so the installation looks routine to users and to most monitoring. The changes route all traffic to the relay and remove the isolation that limits what a coding agent can do on the host. Because the relay-issued credentials are set as user-wide environment variables, other tools on the same machine can read them too. Most affected workplaces appear to be ones where employees wanted a Western coding agent that is not sold in their market.
Why it matters
Coding agents read files, hold secrets and run commands. A reseller in the middle sees everything the agent sees and, with the sandbox off, could make a fabricated response execute with the user’s full privileges. The case shows that export and sales restrictions on frontier tools create a grey market whose risks fall on the users’ employers, not on the vendors.
Sources
2 sources from 2 sites. Numbers match the chips in the text.
2 sources: 1 primary, 1 press
Primary
- Symantec Threat Hunter Team: Sandbox flipped to ‘danger-full-access’: unauthorized AI relays create risk for organizations (Oct 29)security.com, official
Press
Changes
- Filed from Symantec’s report, read directly (news agent; Dark Reading’s write-up returned 403)