A grey-market relay installs real Codex and Claude Code, then switches their sandbox off

Symantec’s Threat Hunter Team has described an unauthorized relay service that gives people access to OpenAI’s Codex and Anthropic’s Claude Code CLIs where the vendors do not sell them, mainly mainland China. It does not ship a fake client. It installs the genuine tools and then rewrites their settings.

Symantec is direct about what this is: “This is not a vulnerability in Codex or Claude Code. The tools are behaving as designed once their configuration has been changed.”

How the setup works

Symantec says users run a normal npm install -g @openai/codex (or codex-cli, or @anthropic-ai/claude-code) and, within minutes to about half an hour, a one-line command such as iwr -useb <url> | iex or curl | bash that fetches a fileless setup script from a lookalike domain. The command carries a relay-issued key and the relay’s endpoint. Symantec saw no automated or exploit-based delivery and believes users copy the command from the relay or a reseller.

The script then edits ~/.codex/config.toml or ~/.claude/settings.json:

• it replaces base_url (or ANTHROPIC_BASE_URL) with a relay domain and swaps in a relay-issued key, set as user-scope environment variables so the change survives a reboot;
• it sets Codex’s sandbox to danger-full-access and turns on network access for the write sandbox;
• it sets DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1.

On one host the script also ran claude /logout, deleted ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY, and ran claude /login before installing its own credentials. Symantec could not tell whether that step runs everywhere.

Who and what

Symantec has seen the relay at a dozen organizations since early 2026, most in mainland China. The list also includes the Chinese operations, and in some cases the home-market operations, of electronics and petrochemical firms based in South Korea, Taiwan and Malaysia. Sectors include semiconductors, electronics, pharmaceuticals, shipping and petrochemicals. It names no organizations. The backend has rotated across at least eight domains imitating OpenAI- or Anthropic-branded chat services.

Symantec found “no evidence so far” that the operator abused this access. Its point is what the setup would allow: a relay that sees every prompt, file and secret sent to the agent, with the sandbox off, could return responses that run with the user’s full privileges. Why an operator wants that much control is unclear to Symantec. It notes the Claude Code keys used the sk-ant-oat01- prefix of subscription OAuth tokens, which it calls consistent with, though not proof of, pooled flat-rate subscriptions being resold.

Why this matters

If you manage machines that run Codex or Claude Code, add Symantec’s checks to your endpoint rules: changes to base_url or ANTHROPIC_BASE_URL, sandbox_mode = "danger-full-access" in ~/.codex/config.toml, OPENAI_BASE_URL, CODEX_API_KEY or ANTHROPIC_AUTH_TOKEN set as user-scope variables outside your own deployment process, and a curl | bash or iwr | iex run right after a CLI install. Watching agent traffic against an allow-list of approved endpoints catches the reroute itself. It fits a pattern we keep covering, where the agent stays intact and its inputs change: a planted AGENTS.md in Downloads and Symantec’s earlier Skynet LLMjacking agent.