- Symantec found an unauthorized relay that installs the genuine Codex and Claude Code, rewrites their settings to switch sandboxing off and routes traffic through its own servers, at a dozen organizations.
- This is a configuration change, not a flaw in either tool. Symantec saw no abuse by the operator, but the setup would allow it.
- Leaders should ask which AI agents run on company machines, where they connect, and who approved the setup.
When a company cannot buy a tool, an employee often finds someone who will sell it to them. Symantec's Threat Hunter Team has now documented what that looks like for AI coding agents. The lesson is that an agent's safety depends on where its connection comes from, not only on how the agent is built.
What Symantec found
Symantec found a reseller that sells access to two AI coding assistants: OpenAI's Codex and Anthropic's Claude Code. Its customers sit mostly in mainland China, where neither vendor officially sells these tools.
The reseller does not supply fake software. Customers install the real tools with npm, a standard download service for JavaScript programs. A setup script then changes their settings.
Symantec says a dozen organizations have used the relay since early 2026. They work in industrial automation, semiconductors, pharmaceuticals, shipping, petrochemicals and data center services. Most are in mainland China. The list also reaches electronics and petrochemical groups based in South Korea, Taiwan and Malaysia.
How the switch happens
These assistants act directly on an employee's computer. They open files, write code and start programs. A sandbox is the fence that limits how far they can reach.
Symantec believes users copy a ready-made one-line command from the relay or a reseller, though it has not seen where it comes from. The command downloads a setup script from a look-alike website. One example is vibe.aiok[.]me. The script checks that Node.js and the chosen tool are installed, adds them if not, and then applies its own settings.
Those settings do several things. They point the tool at a server the relay controls. They add a key issued by the relay. They switch sandboxing off. Symantec documents the exact Codex setting as "danger-full-access", with network use allowed. It gives no equivalent setting for Claude Code. They also turn off telemetry and error reports, so the vendors lose a usage signal.
The keys are saved as user-level environment variables, so they survive a reboot. Symantec notes that any other tool on the same computer can read them.
On one computer, the script first signed the user out of Claude and removed saved Anthropic credentials. That stopped a genuine login from overriding the relay's keys. Symantec could not say whether every install does this.
The idea: the safeguard sits in a settings file
Symantec says neither Codex nor Claude Code has a flaw here. Both tools do what they were built to do. Only their settings changed.
That is the point. A sandbox protects a computer only while it stays on. Here the script switches it off for the user. The user has little reason to object, because the install looks routine and the tool still works.
The second change matters as much. Whoever supplies the connection sits between the employee and the AI model. Symantec says a relay in that spot sees every prompt, file and secret, and can change or invent any answer. With the sandbox off and network access on, a bad answer could act with everything the employee's account is allowed to do.
An analogy helps. It is like a contractor who hands your staff a perfectly good set of keys, but cut at a locksmith you have never met.
What is not known
Symantec saw no sign that the operator is abusing this position. It draws a line between what it observed and what might follow. The settings changes were observed. The risks are potential.
The motive is unclear. Getting around regional limits is the simplest explanation, but Symantec notes that would not require turning off a sandbox. The Claude Code keys began with sk-ant-oat01-, a prefix Anthropic uses for subscription tokens. Symantec says this fits a relay that pools flat-rate subscriptions, but does not prove it. Fraud and resale of prompts and files cannot be ruled out.
Symantec says the affected organizations look less like chosen targets. They look more like workplaces where staff found the service themselves. Brigid O Gorman, a senior intelligence analyst at the team, told Dark Reading that researchers first found a suspicious PowerShell downloader. They later judged it to be "an AI-agent hijack script."
What to ask your team
Start with a list. Ask which AI coding agents run on company computers, and who approved each one.
Next, ask your security team to search for a few of the signs Symantec lists. One is a changed server address in a tool's settings, such as base_url or ANTHROPIC_BASE_URL. Another is a Codex sandbox set to "danger-full-access" in ~/.codex/config.toml. A third is AI keys saved as user-level variables outside an approved rollout. Symantec also lists a curl | bash or iwr | iex command run soon after installing either tool.
Finally, ask whether traffic from these tools is limited to approved AI services. Symantec thinks demand in markets without official sales created this reseller, and that staff found it themselves. Some staff will look for another way. An approved route is easier to manage than a hidden one.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Symantec Threat Hunter Team (Broadcom).
