Severity moderate: Other parties' data or systems were touched, and a source states how far it reached. The relay's configuration would let it read every prompt, file and secret passed through the agent and run commands with the user's full privileges, across a dozen organizations, though no abuse has been observed.
Earliest source we hold 2026-10-29 · Captured by AI Risk Wire 2026-10-29 16:38 UTC
An unauthorized relay service installed genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems and reconfigured them to route requests through third-party servers, disabling the sandbox (danger-full-access), enabling network access, replacing credentials with relay tokens, and disabling telemetry.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingEmployees at a dozen organizations, mostly in mainland China, installed genuine OpenAI Codex or Anthropic Claude Code CLIs via npm, then ran a relay's one-line setup script that reconfigured the CLIs to route requests through third-party servers with the sandbox disabled.
2 · What went wrongThe relay's script rewrote the CLI configuration, disabling the execution sandbox (danger-full-access), enabling network access, replacing real API credentials with relay tokens, and disabling telemetry, stripping the safeguards meant to contain the agent.
3 · What it reached or didThe relay could read every prompt, file and secret passed through the agent and run commands with the user's full privileges; user-scope environment variables could be picked up by other tools on the same machine.
4 · How it was caughtSymantec's Threat Hunter Team identified the unauthorized relay service.
5 · What was doneSymantec advises organizations to watch endpoints for base_url changes, danger-full-access sandbox settings, user-scope environment variables, iwr|iex or curl|bash after npm install, and traffic outside approved AI endpoints.
What the sources state
Other parties affected 12
Cause a permission, scope or wiring error
No source states: when it happened, when it was found, how many records were exposed, the direct loss, any court case, what set it off.
Full access to the host with the user's privileges; sandbox set to danger-full-access and network access enabled for the write sandbox.
C one secondary source states it
Safeguards in place
sandbox
C one secondary source states it
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
Whose system
company using AI
D inferred by us from the described behaviour, reason shown
How it was connected
CLI installed via npm, reconfigured to route through third-party relay
C one secondary source states it
What it was for
AI coding assistant: read files, write code, and run commands on the host
C one secondary source states it
State of its safeguards
Sandbox disabled (danger-full-access), network access enabled for write sandbox, telemetry and error reporting disabled, credentials replaced with relay-issued tokens
C one secondary source states it
What happened
Earliest source we hold
2026-10-29
A the date the source itself carries
Who caught it
an outside party
C one secondary source states it
Themes
unauthorized relay, AI coding CLI, sandbox disabled, credential replacement, telemetry disabled, shadow AI
C one secondary source states it
Near miss
yes, no harm happened
C one secondary source states it
Cause
a permission, scope or wiring error
D inferred by us from the described behaviour, reason shown
Cause in detail
The relay rewrote the CLI configuration files, replacing base_url and API keys and setting sandbox_mode to danger-full-access, so the tools ran with safeguards stripped.
D inferred by us from the described behaviour, reason shown
Who caused it
an outside attacker
D inferred by us from the described behaviour, reason shown
Where its input came from
One-line setup command copied from the relay or its reseller and run by the user
C one secondary source states it
What was done
Watch endpoints for base_url changes, sandbox_mode danger-full-access, user-scope environment variables, iwr|iex or curl|bash after npm install, and traffic outside approved AI endpoints.
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it
What it did
The relay replaced the user's real API credentials with relay-issued tokens and established them as user-scope environment variables, and disabled the sandbox.
D inferred by us from the described behaviour, reason shown
Impact
Other parties affected
12
C one secondary source states it
Severity
moderate
D inferred by us from the described behaviour, reason shown
Who was affected
A dozen organizations, most in mainland China, plus multinational subsidiaries in South Korea, Taiwan, and Malaysia
C one secondary source states it
Kinds of data exposed
credentials, prompts, files, secrets
C one secondary source states it
Why this severity
Other parties' data or systems were touched, and a source states how far it reached. The relay's configuration would let it read every prompt, file and secret passed through the agent and run commands with the user's full privileges, across a dozen organizations, though no abuse has been observed.
D inferred by us from the described behaviour, reason shown
Context
Industry
Industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services
C one secondary source states it
Country
China
C one secondary source states it
LR-2026-0268 · version 2 · published 2026-10-29 after automatic checks; not yet checked field by field by a person · changes to this case · JSON