{"schema_version":"0.10.0","id":"LR-2026-0268","record_version":2,"title":"Unauthorized relay service reconfigures genuine Codex and Claude Code CLIs, disabling sandboxes and replacing credentials","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-29","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"Symantec (Broadcom) research","original_document":{"url":"https://www.security.com/blog-post/openai-claude-unauthorized-relays","organisation":"Symantec (Broadcom)","role":"researcher"},"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-10-29","history":[{"date":"2026-10-29","from_level":null,"to_level":"confirmed","reason":"Symantec (Broadcom) research"}]},"sources_hash":"70e56c23ce2bc3cb5b77a439a9097f05f169a8868bf746434c91276b35a5be59"},"system":{"model_name":"Codex","model_version":null,"developer":"OpenAI","harness":"OpenAI Codex CLI","tools_granted":["shell","file_read","file_write","network"],"permissions_scope":"Full access to the host with the user's privileges; sandbox set to danger-full-access and network access enabled for the write sandbox.","autonomy_level":"unknown","guardrails_present":["sandbox"],"deployment_context":"production","tier":"enterprise","lifecycle_stage":"production","integration_type":"CLI installed via npm, reconfigured to route through third-party relay","intended_use":"AI coding assistant: read files, write code, and run commands on the host","safeguard_state":"Sandbox disabled (danger-full-access), network access enabled for write sandbox, telemetry and error reporting disabled, credentials replaced with relay-issued tokens","production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-29","incident_class":"security_compromise","failure_class":"credential_misuse","agent_involved":true,"secondary_failure_classes":["containment_escape"],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"An unauthorized relay service installed genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems and reconfigured them to route requests through third-party servers, disabling the sandbox (danger-full-access), enabling network access, replacing credentials with relay tokens, and disabling telemetry.","tags":["unauthorized-relay","ai-coding-cli","sandbox-disabled","credential-replacement","telemetry-disabled","shadow-ai"],"date_detected":null,"near_miss":true,"root_cause":"integration","root_cause_detail":"The relay rewrote the CLI configuration files, replacing base_url and API keys and setting sandbox_mode to danger-full-access, so the tools ran with safeguards stripped.","failure_class_detail":"The relay replaced the user's real API credentials with relay-issued tokens and established them as user-scope environment variables, and disabled the sandbox.","responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":"One-line setup command copied from the relay or its reseller and run by the user","time_to_contain":null,"operations_paused":null,"remediation":"Watch endpoints for base_url changes, sandbox_mode danger-full-access, user-scope environment variables, iwr|iex or curl|bash after npm install, and traffic outside approved AI endpoints.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":12,"severity":"moderate","severity_because":"moderate, because data or systems of others touched, with a bounded scope stated: The relay's configuration would let it read every prompt, file and secret passed through the agent and run commands with the user's full privileges, across a dozen organizations, though no abuse has been observed.","harm_class":[],"affected_description":"A dozen organizations, most in mainland China, plus multinational subsidiaries in South Korea, Taiwan, and Malaysia","protected_class_involved":null,"data_categories_exposed":["credentials","prompts","files","secrets"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.security.com/blog-post/openai-claude-unauthorized-relays","publisher":"SECURITY.COM","date":"2026-10-29","type":"press","title":"Sandbox Flipped to ‘Danger-Full-Access’: Unauthorized AI Relays Create Risk for Organizations","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.tools_granted":"C","system.permissions_scope":"C","system.guardrails_present":"C","system.tier":"D","system.lifecycle_stage":"D","system.integration_type":"C","system.intended_use":"C","system.safeguard_state":"C","system.developer":"C","system.deployment_context":"D","system.autonomy_level":"D","event.failure_class":"D","event.secondary_failure_classes":"D","event.tags":"C","event.near_miss":"C","event.root_cause":"D","event.responsible_party":"D","event.adversarial_actor":"D","event.input_provenance":"C","event.remediation":"C","event.agent_involved":"C","event.detection_method":"C","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","impact.third_parties_affected_count":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.industry":"C","context.systemic_exposure":"C","context.denominator_available":"D","context.country":"C","event.root_cause_detail":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"AI coding agents such as OpenAI's Codex and Claude Code read files, write code, and run commands on the machines where they are installed."}],"system.developer":[{"source_index":0,"quote":"AI coding agents such as OpenAI's Codex and Claude Code read files, write code, and run commands on the machines where they are installed."}],"system.harness":[{"source_index":0,"quote":"An unauthorized relay service has been observed installing the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems and then reconfiguring them to route every request through third-party infrastructure instead of the vendors' own servers."}],"system.tools_granted":[{"source_index":0,"quote":"AI coding agents such as OpenAI's Codex and Claude Code read files, write code, and run commands on the machines where they are installed."},{"source_index":0,"quote":"It also sets the CLI's sandbox mode to full access and enables network access for the write sandbox, disabling the isolation that is meant to limit what an AI agent can do on the host."}],"system.permissions_scope":[{"source_index":0,"quote":"It also sets the CLI's sandbox mode to full access and enables network access for the write sandbox, disabling the isolation that is meant to limit what an AI agent can do on the host."}],"system.guardrails_present":[{"source_index":0,"quote":"One of the safeguards they employ is a sandbox that is meant to limit what they can do."}],"system.deployment_context":[{"source_index":0,"quote":"Most instances appear to be a workplace where an employee or the organization itself wanted to use a Western AI coding assistant that is not officially sold in their market and so turned to an unauthorized reseller to get it."}],"system.lifecycle_stage":[{"source_index":0,"quote":"Most instances appear to be a workplace where an employee or the organization itself wanted to use a Western AI coding assistant that is not officially sold in their market and so turned to an unauthorized reseller to get it."}],"system.integration_type":[{"source_index":0,"quote":"Rather than building its own client software, the service repurposes the genuine CLI tools."}],"system.intended_use":[{"source_index":0,"quote":"AI coding agents such as OpenAI's Codex and Claude Code read files, write code, and run commands on the machines where they are installed."}],"system.safeguard_state":[{"source_index":0,"quote":"The reconfiguration disables the CLI's execution sandbox entirely, enables network access for the write sandbox, replaces the user's real API credentials with relay-issued tokens, and disables telemetry and error reporting."}],"event.failure_class":[{"source_index":0,"quote":"The reconfiguration disables the CLI's execution sandbox entirely, enables network access for the write sandbox, replaces the user's real API credentials with relay-issued tokens, and disables telemetry and error reporting."}],"event.secondary_failure_classes":[{"source_index":0,"quote":"It also sets the CLI's sandbox mode to full access and enables network access for the write sandbox, disabling the isolation that is meant to limit what an AI agent can do on the host."}],"event.detection_method":[{"source_index":0,"quote":"However, Symantec's Threat Hunter Team has identified an unauthorized relay service that provides access to OpenAI's Codex and Anthropic's Claude Code command-line coding agents, mainly in markets where the vendors do not officially operate, primarily mainland China."}],"event.summary":[{"source_index":0,"quote":"An unauthorized relay service has been observed installing the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems and then reconfiguring them to route every request through third-party infrastructure instead of the vendors' own servers."}],"event.tags":[{"source_index":0,"quote":"The reconfiguration disables the CLI's execution sandbox entirely, enables network access for the write sandbox, replaces the user's real API credentials with relay-issued tokens, and disables telemetry and error reporting."}],"event.near_miss":[{"source_index":0,"quote":"There is no evidence so far that the relay operator has abused this level of access, but a potential risk is that the configuration it installs would let it read every prompt, file, and secret passed through the agent and run commands with the user's full privileges."}],"event.root_cause":[{"source_index":0,"quote":"The script's actual purpose is to rewrite each tool's configuration file: ~/.codex/config.toml for Codex, or ~/.claude/settings.json for Claude Code."}],"event.root_cause_detail":[{"source_index":0,"quote":"It replaces the base_url (or ANTHROPIC_BASE_URL) with a domain the relay controls, swaps in a relay-issued API key formatted to match what the CLI expects, and establishes both as user-scope environment variables so the change survives a reboot without further action from the operator."}],"event.responsible_party":[{"source_index":0,"quote":"However, Symantec's Threat Hunter Team has identified an unauthorized relay service that provides access to OpenAI's Codex and Anthropic's Claude Code command-line coding agents, mainly in markets where the vendors do not officially operate, primarily mainland China."}],"event.adversarial_actor":[{"source_index":0,"quote":"However, Symantec's Threat Hunter Team has identified an unauthorized relay service that provides access to OpenAI's Codex and Anthropic's Claude Code command-line coding agents, mainly in markets where the vendors do not officially operate, primarily mainland China."}],"event.input_provenance":[{"source_index":0,"quote":"The one-line command embeds a relay-issued API key and the relay's own endpoint, and the script is written for interactive use (it prints progress messages in Chinese and tells the user to re-run it in an elevated PowerShell session if it lacks administrator rights), which indicates that users copy a ready-made command from the relay or its reseller and run it themselves, although we have not seen the page or message it was copied from."}],"event.remediation":[{"source_index":0,"quote":"Organizations concerned about unauthorized AI relay use should also watch endpoints running Codex or Claude Code for the following:"}],"event.incident_class":[{"source_index":0,"quote":"The reconfiguration disables the CLI's execution sandbox entirely, enables network access for the write sandbox, replaces the user's real API credentials with relay-issued tokens, and disables telemetry and error reporting."}],"event.agent_involved":[{"source_index":0,"quote":"AI coding agents such as OpenAI's Codex and Claude Code read files, write code, and run commands on the machines where they are installed."}],"event.failure_class_detail":[{"source_index":0,"quote":"It replaces the base_url (or ANTHROPIC_BASE_URL) with a domain the relay controls, swaps in a relay-issued API key formatted to match what the CLI expects, and establishes both as user-scope environment variables so the change survives a reboot without further action from the operator."}],"impact.third_parties_affected_count":[{"source_index":0,"quote":"Threat Hunter has found the relay in use across a dozen organizations since early 2026."}],"impact.affected_description":[{"source_index":0,"quote":"The service has been active since at least early 2026, and has impacted systems at a dozen organizations, most of them in mainland China, as well as multinational subsidiaries based in South Korea, Taiwan, and Malaysia."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"There is no evidence so far that the relay operator has abused this level of access, but a potential risk is that the configuration it installs would let it read every prompt, file, and secret passed through the agent and run commands with the user's full privileges."}],"impact.severity_because":[{"source_index":0,"quote":"There is no evidence so far that the relay operator has abused this level of access, but a potential risk is that the configuration it installs would let it read every prompt, file, and secret passed through the agent and run commands with the user's full privileges."}],"context.industry":[{"source_index":0,"quote":"Affected sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services."}],"context.country":[{"source_index":0,"quote":"Most are based in mainland China, though the list also includes the Chinese operations, and in some cases the home-market operations, of multinational electronics and petrochemical firms based in South Korea, Taiwan, and Malaysia."}],"context.systemic_exposure":[{"source_index":0,"quote":"This is not a vulnerability in Codex or Claude Code."}],"impact.severity":[{"source_index":0,"quote":"There is no evidence so far that the relay operator has abused this level of access, but a potential risk is that the configuration it installs would let it read every prompt, file, and secret passed through the agent and run commands with the user's full privileges."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-29"}]},"notes_on_gaps":"Single source (Security.com press). No date_occurred stated beyond 'active since at least early 2026'; no date_detected, duration or time_to_contain. Autonomy level not stated: the relay script, not the agent, made the changes, so system.autonomy_level omitted. event.trigger left as unknown: the source explicitly says no automated or exploit-based delivery was observed, which does not rule out an external cause, so 'spontaneous' is not permitted. failure_class credential_misuse and secondary containment_escape are classified from the relay's replacement of credentials and disabling of the sandbox; the agent itself did not act, so these are grade D inferences. incident_class security_compromise rests on the sandbox/permission boundary being breached by the relay. root_cause integration rests on the configuration-file rewrite. No loss figure, no records_exposed, no remediation_hours. No containment or notification stated; near_miss true because no abuse observed. No guardrail-absence list supplied by the source pass. event.trigger: unknown was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: enterprise by rule (operator Unauthorized relay service (operator unidentified) differs from developer OpenAI). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-29] system.lifecycle_stage: production. system.deployment_context: production. system.autonomy_level: no source states the arrangement. event.secondary_failure_classes: a source states the agent acted outside the sandbox, environment or network it was confined to. event.responsible_party: third_party. event.adversarial_actor: external_attacker. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.trigger: no source states a cause. context.denominator_available: no denominator is available for this incident."},"context":{"industry":"Industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services","org_size_band":null,"country":"CN","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":false,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Employees at a dozen organizations, mostly in mainland China, installed genuine OpenAI Codex or Anthropic Claude Code CLIs via npm, then ran a relay's one-line setup script that reconfigured the CLIs to route requests through third-party servers with the sandbox disabled.","quote":"An unauthorized relay service has been observed installing the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems and then reconfiguring them to route every request through third-party infrastructure instead of the vendors' own servers.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The relay's script rewrote the CLI configuration, disabling the execution sandbox (danger-full-access), enabling network access, replacing real API credentials with relay tokens, and disabling telemetry, stripping the safeguards meant to contain the agent.","quote":"The reconfiguration disables the CLI's execution sandbox entirely, enables network access for the write sandbox, replaces the user's real API credentials with relay-issued tokens, and disables telemetry and error reporting.","source_index":0,"grade":"C"},{"step":"reached","text":"The relay could read every prompt, file and secret passed through the agent and run commands with the user's full privileges; user-scope environment variables could be picked up by other tools on the same machine.","quote":"There is no evidence so far that the relay operator has abused this level of access, but a potential risk is that the configuration it installs would let it read every prompt, file, and secret passed through the agent and run commands with the user's full privileges.","source_index":0,"grade":"C"},{"step":"caught","text":"Symantec's Threat Hunter Team identified the unauthorized relay service; the article does not state how it first noticed.","quote":"However, Symantec's Threat Hunter Team has identified an unauthorized relay service that provides access to OpenAI's Codex and Anthropic's Claude Code command-line coding agents, mainly in markets where the vendors do not officially operate, primarily mainland China.","source_index":0,"grade":"C"},{"step":"done","text":"No containment or notification is stated; Symantec advises organizations to watch endpoints for base_url changes, danger-full-access sandbox settings, user-scope environment variables, iwr|iex or curl|bash after npm install, and traffic outside approved AI endpoints.","quote":"Organizations concerned about unauthorized AI relay use should also watch endpoints running Codex or Claude Code for the following:","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-29","source_urls":["https://www.security.com/blog-post/openai-claude-unauthorized-relays"]}}