Several companies—mostly based in mainland China but with operations in Taiwan, Malaysia, and South Korea—are falling victim to a relay service that redirects OpenAI Codex and Anthropic Claude Code traffic through unauthorized servers. The scheme, discovered by a security team earlier this year, involves no hacks of the tools themselves; instead, the attackers manipulate configurations and prompt workflows after users install genuine software.
How the Relay Service Works
The attack starts when users install Codex or Claude Code via standard package manager commands. Later, they’re instructed—often by resellers or the relay service itself—to run a single line of setup code. That script is hosted on domains masquerading as benign AI tool providers and fetched using commands like curl | bash or PowerShell equivalents.
The script runs in memory, checking for the presence of Node.js or the tools in question, and installing them if missing. Then it silently modifies configuration files (such as ~/.codex/config.toml or ~/.claude/settings.json) to reroute traffic to relay-controlled domains, embed the relay’s API keys, disable telemetry and error reporting, enable broad network access in the tool’s sandbox, and ensure settings survive reboots. On some machines, it also logs out existing sessions and replaces credentials so all activity flows through the relay.
Scope, Risks, and Indicators
At least a dozen organizations in sectors including semiconductors, pharmaceuticals, data centers, petrochemicals, manufacturing, shipping, and industrial automation have been impacted since early 2026. Although no evidence was found of active abuse such as executing malicious code or exfiltrating data, the configuration changes make enterprise data, credentials, secrets, and user files visible to the relay operator. If malicious commands were delivered, they could execute under full user privileges.
The operator’s motives aren’t fully clear. One possible reason is to bypass regional restrictions to AI services—but tampering with sandbox settings isn’t necessary just for that. Another is subscription fraud: issuing subscription keys that work across multiple users. That raises concerns over unauthorized sharing or resale of prompts and data that passes through the relay.
Security teams should watch for changes to configuration fields like base_url, sandbox_mode switched to “danger-full-access”, and environment variables named OPENAI_BASE_URL, CODEX_API_KEY, or ANTHROPIC_AUTH_TOKEN. Also suspect any curl | bash or PowerShell one-liners executed shortly after installing these tools. Multiple relay-related domains have been identified, and matching SHA-256 hashes of setup scripts are available as IoCs.
Background and Context
Codex and Claude Code are AI-powered developer tools used for code generation and assistance. They’re typically protected behind sandboxes that limit what the AI can and cannot do. Disabling sandbox restrictions and turning on unfiltered network access weakens these defenses and exposes sensitive data.
This incident adds to a growing pattern of attacks exploiting configuration settings rather than software vulnerabilities. Previous incidents included malicious npm packages that extracted authentication tokens and flaws in Claude Code’s sandbox that stayed hidden for months.
Permissions, protection, and people: Organizations relying on AI developer tools must treat them like any endpoint—and configure them securely. Turning off telemetry and sandboxing opens up windows for surveillance or sabotage. Even without evidence of a breach, the potential damage is huge.
