AI relays: a setup script points Codex and Claude Code at a proxy

01What happened

Symantec's Threat Hunter Team published its findings on October 29, 2026, after tracking a grey market relay service active since at least early 2026. About a dozen organizations are affected, most in mainland China, along with the Chinese operations of companies based in South Korea, Taiwan and Malaysia. Affected sectors include semiconductors, pharmaceuticals, shipping and data center services.

02How it works

Users run a one line fileless installer, iwr -useb <url> | iex on Windows or curl | bash on other hosts, from a lookalike domain, usually within half an hour of a legitimate npm install of either CLI. The script installs Node.js and the genuine clients if they are missing, then rewrites ~/.codex/config.toml and ~/.claude/settings.json so that base_url and ANTHROPIC_BASE_URL point at the relay. It also sets sandbox_mode to danger-full-access and network_access to true, swaps the user's real API credentials for relay-issued keys, and sets DISABLE_TELEMETRY and DISABLE_ERROR_REPORTING at user scope so the changes survive a reboot.

03Who is affected

Developers who set up Codex or Claude Code through a relay or a reseller instead of from OpenAI or Anthropic are exposed, on Windows and on bash hosts. Symantec says the operator is positioned to read prompts, files and secrets and to run commands with the user's privileges, and reports no evidence that it has done so.

04What to do

Check ~/.codex/config.toml and ~/.claude/settings.json for a base_url or ANTHROPIC_BASE_URL that is not the vendor's, and for sandbox_mode set to danger-full-access. Look for OPENAI_BASE_URL, CODEX_API_KEY or ANTHROPIC_AUTH_TOKEN set as user scope environment variables outside an approved deployment, and for iwr | iex or curl | bash run around an npm install of either CLI. Rotate any provider key that passed through a relay.

Questions people ask

How do I tell whether my Claude Code install points at an unauthorized relay?

Claude Code reads ANTHROPIC_BASE_URL from ~/.claude/settings.json and from the environment, so check both for a host that is not api.anthropic.com. Symantec also flags ANTHROPIC_AUTH_TOKEN set as a user scope environment variable outside an approved deployment. Anthropic documents both variables and legitimate gateway setups use them, so an unexpected value matters more than mere presence.

Does the relay ship a modified Codex or Claude Code client?

Symantec reports that the relay installs the genuine OpenAI and Anthropic CLIs and does not distribute a modified client. The compromise lives in configuration: the installer changes the API endpoint, swaps in relay-issued credentials, and switches off sandboxing and telemetry. Comparing file hashes of the CLI itself will therefore find nothing, while a configuration review will.

What does sandbox_mode danger-full-access change in Codex?

Setting sandbox_mode to danger-full-access lifts the filesystem and network limits Codex normally applies to commands it runs. OpenAI's config reference lists the value as one an organization can disallow through managed configuration. Symantec says the relay installer sets it alongside network_access true, so an agent that would have been confined instead runs with the user's full privileges.

Should affected organizations rotate their AI provider keys?

Organizations that find a relay endpoint in a Codex or Claude Code configuration should rotate the affected provider keys, because the installer replaced real credentials with relay-issued ones and routed traffic through servers the operator controls. Symantec observed no abuse but describes the operator as able to read prompts, files and secrets from that position.

Sources 3 links, all fetched

1. 1security.comSymantec Research
2. 2learn.chatgpt.comCodex Config Reference
3. 3code.claude.comClaude Code Env Vars