{"schema":"postcutoff/event@1","as_of":"2026-11-03T13:35:00+01:00","url":"https://postcutoff.com/e/2026-10-29-symantec-grey-market-relay-codex-claude-code-sandbox-off/","md":"https://postcutoff.com/e/2026-10-29-symantec-grey-market-relay-codex-claude-code-sandbox-off/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-29-symantec-grey-market-relay-codex-claude-code-sandbox-off","date":"2026-10-29","date_precision":"day","short_title":"Symantec: a grey-market relay installs the real Codex and Claude Code CLIs in China-based firms, then switches their sandboxes off and routes every prompt through its own servers","deck":null,"takeaway":"Symantec saw no abuse yet, but notes the operator could read every prompt, file and secret and run commands with the user's privileges.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"Symantec Threat Hunter Team: Sandbox flipped to 'danger-full-access': unauthorized AI relays create risk for organizations (Oct 29)","url":"https://www.security.com/threat-intelligence/openai-claude-unauthorized-relays","type":"official","group":"primary","domain":"security.com"},{"n":2,"title":"Dark Reading: Shadowy AI relay disables OpenAI Codex, Claude Code sandboxes (Oct 29; 403 for us)","url":"https://www.darkreading.com/threat-intelligence/ai-relay-service-openai-codex-claude-code-sandboxes","type":"press","group":"press","domain":"darkreading.com"}],"official":1,"filed":"2026-10-29","updated":"2026-10-29","orgs":["Symantec","Broadcom","OpenAI","Anthropic"],"title":"Symantec: a grey-market relay installs the real Codex and Claude Code CLIs in China-based firms, then switches their sandboxes off and routes every prompt through its own servers","summary":"On Oct 29, 2026 Symantec's Threat Hunter Team (Broadcom) reported an unauthorized relay service, active since early 2026 at about a dozen organizations, mostly in mainland China, that installs the genuine OpenAI Codex and Anthropic Claude Code command-line agents and then rewrites their configuration: requests go to the relay's servers, relay-issued keys replace the user's credentials, the execution sandbox is set to full access and telemetry is turned off. Symantec saw no abuse yet, but notes the operator could read every prompt, file and secret and run commands with the user's privileges.","key_facts":["Scope (Symantec, Oct 29): about a dozen organizations since at least early 2026, most in mainland China, plus Chinese operations (and in some cases home-market operations) of South Korean, Taiwanese and Malaysian multinationals; sectors include industrial automation, electronics, semiconductors, pharmaceuticals, shipping, tyres, petrochemicals and data-centre services","How it arrives: users run a legitimate npm install of @openai/codex or @anthropic-ai/claude-code, then within minutes to about half an hour a one-line PowerShell/bash command fetched from a lookalike domain; Symantec saw no exploit-based delivery and concludes users copy a ready-made command from the reseller","What it changes: the CLI's base URL and API key point to the relay; Codex's sandbox_mode is set to 'danger-full-access' and network access is enabled for the write sandbox; telemetry and error reporting are disabled; on one host the script logged the user out of a legitimate Anthropic session before installing relay credentials","Symantec: 'This is not a vulnerability in Codex or Claude Code. The tools are behaving as designed once their configuration has been changed.' 'There is no evidence the operator is currently abusing its position'","Business model (Symantec's reading): bypassing regional restrictions is the simplest explanation, but it does not require disabling the sandbox; the Claude Code keys used the sk-ant-oat01- prefix of subscription OAuth tokens, 'consistent with, though not proof of', pooled flat-rate subscriptions resold to many customers","Infrastructure rotated across at least eight domains impersonating OpenAI- or Anthropic-branded chat services; Symantec lists detection hints (base-URL changes, 'danger-full-access' in ~/.codex/config.toml, user-scope credential variables)","Context: OpenAI and Anthropic do not sell their coding agents in mainland China; Anthropic has fought resellers and distillation (2026-06-24, 2026-10-28 entries), and China's NVDB called Claude Code's hidden China-user markers a 'backdoor' (2026-07-01 entry)"],"key_numbers":[],"tags":["cybersecurity","coding-agents","codex","claude-code","sandbox","china","resellers","supply-chain"],"science":null,"body_md":"## What happened\n\nSymantec found that the relay does not ship a modified client. It installs the real tools from npm and then changes their settings,\nso the installation looks routine to users and to most monitoring. The changes route all traffic to the relay and remove the\nisolation that limits what a coding agent can do on the host. Because the relay-issued credentials are set as user-wide environment\nvariables, other tools on the same machine can read them too. Most affected workplaces appear to be ones where employees wanted a\nWestern coding agent that is not sold in their market.\n\n## Why it matters\n\nCoding agents read files, hold secrets and run commands. A reseller in the middle sees everything the agent sees and, with the\nsandbox off, could make a fabricated response execute with the user's full privileges. The case shows that export and sales\nrestrictions on frontier tools create a grey market whose risks fall on the users' employers, not on the vendors.","disputed":[],"related":[{"id":"2026-10-28-information-deepseek-moonshot-distilled-gpt-6-astra","url":"https://postcutoff.com/e/2026-10-28-information-deepseek-moonshot-distilled-gpt-6-astra/","date":"2026-10-28","date_precision":"day","short_title":"The Information: DeepSeek and Moonshot relied heavily on GPT-6 Astra outputs to train V4.1-Flash 1017 and Kimi K3.1 Pro","deck":null,"takeaway":"The claim is unconfirmed by the companies; it follows OpenAI's Sept 30 report linking a distillation campaign to people associated with Moonshot.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":4,"official":0,"filed":"2026-10-29","updated":"2026-10-29","orgs":["OpenAI","DeepSeek","Moonshot AI"]},{"id":"2026-10-21-symantec-skynet-mode-llmjacking-agent","url":"https://postcutoff.com/e/2026-10-21-symantec-skynet-mode-llmjacking-agent/","date":"2026-10-21","date_precision":"day","short_title":"Symantec: offensive agent hijacks LLMs in 'Skynet mode'","deck":null,"takeaway":"It is a concrete look at how criminals are packaging agentic attacks: not a frontier lab's model behind safeguards, but someone else's exposed endpoint doing the thinking, with the victim paying for inference.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":2,"official":1,"filed":"2026-10-22","updated":"2026-10-22","orgs":["Symantec"]},{"id":"2026-10-15-symantec-aoki-infostealer-ai-coding-credentials","url":"https://postcutoff.com/e/2026-10-15-symantec-aoki-infostealer-ai-coding-credentials/","date":"2026-10-15","date_precision":"day","short_title":"Symantec: the Aoki infostealer now steals credentials and session files of AI coding assistants (Claude, Codex, Cursor, Gemini, Copilot, Kiro)","deck":null,"takeaway":"AI keys are sold and abused for \"LLMjacking\" (running models on a victim's bill), and coding-agent tokens can open the repositories and pipelines they are connected to.","category":"policy-safety","category_label":"Policy & safety","importance":2,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":1,"official":1,"filed":"2026-10-29","updated":"2026-10-29","orgs":["Symantec","Broadcom"]},{"id":"2026-07-01-claude-code-hidden-china-user-markers","url":"https://postcutoff.com/e/2026-07-01-claude-code-hidden-china-user-markers/","date":"2026-07-01","date_precision":"day","short_title":"Hidden code in Claude Code that flagged likely Chinese users and AI-lab proxies is exposed and removed; China's NVDB calls it a 'backdoor' and Alibaba bans the tool","deck":null,"takeaway":"It showed how far frontier labs had gone in the fight against distillation, and how much trust coding agents need, since they run with full access to developers' machines.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":7,"official":0,"filed":"2026-10-05","updated":"2026-10-05","orgs":["Anthropic","Alibaba"]},{"id":"2026-06-24-anthropic-accuses-alibaba-qwen-distillation","url":"https://postcutoff.com/e/2026-06-24-anthropic-accuses-alibaba-qwen-distillation/","date":"2026-06-24","date_precision":"day","short_title":"Anthropic tells US senators and the White House that Alibaba's Qwen lab ran the largest known distillation campaign on Claude (28.8M exchanges)","deck":null,"takeaway":"It moved the distillation dispute from blog posts to Congress and put Alibaba, China's biggest open-weights lab, at its centre.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":10,"official":0,"filed":"2026-10-04","updated":"2026-10-04","orgs":["Anthropic","Alibaba"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-29","type":"filed","text":"Created from Symantec's report, read directly (news agent; Dark Reading's write-up returned 403)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-29","run":null,"sources_read":"Symantec's report, read directly (news agent; Dark Reading's write-up returned 403)","updated":"2026-10-29","human_review":null,"version":{"date":"2026-10-29"}},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":182,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":121,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":212,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":151,"in_training_data":false}],"short_url":null}