An unauthorized relay installed the real Codex and Claude Code at a dozen organisations, then switched Codex's sandbox to 'danger-full-access'

AI coding agents like OpenAI's Codex and Anthropic's Claude Code read files, write code and run commands on the machine they're installed on. The sandbox is one of the main things stopping them doing whatever they like. On 29 October 2026, Symantec's Threat Hunter Team reported a service that quietly switches it off.

What happened

Symantec says it found an unauthorized relay service that sells access to Codex and Claude Code mainly in markets where the two companies don't officially operate, chiefly mainland China. It has been active since at least early 2026 and turned up at about a dozen organisations. Most were in mainland China, along with operations of companies based in South Korea, Taiwan and Malaysia. The sectors include industrial automation, electronics and semiconductor manufacturing, pharmaceuticals, shipping, tyre makers, petrochemicals and data centre services.

The relay doesn't ship a fake client. Users install the genuine tools the normal way. Then a one-line script, fetched from lookalike domains, rewrites their settings files.

What the script changes

It points the tools at servers the relay controls instead of OpenAI's or Anthropic's, and swaps in an API key the relay issued. Both are saved as user-level environment variables, so they survive a reboot. For Codex it also sets the sandbox mode to "danger-full-access", turns on network access for the write sandbox, and switches off telemetry and error reporting.

On at least one machine, Symantec says, the script logged the user out of Claude Code, deleted their Anthropic login variables and then logged in again with the relay's own credentials.

Why it matters

Symantec says it has seen no evidence that the operator is abusing its position, so the risks are potential, not observed. But anything sent through the relay can be seen by whoever runs it: every prompt, file and secret the agent touches. It could also alter the answers coming back. With the sandbox off and network access on, a malicious or tampered response could run commands with the user's full rights.

Symantec is clear that this isn't a bug in either tool: they behave as designed once their configuration has been changed. Dodging regional restrictions is the simplest explanation, it says, but that doesn't require turning off the sandbox or planting long-lasting credentials, and fraud or resale of the data passing through can't be ruled out.

Our take

This is our opinion. The safety settings for a coding agent live in a plain text file in your home folder, and anything you run can rewrite them. If your company uses these tools, watch for changes to their endpoint and sandbox settings, block unapproved relays, and give people an approved way to use the tools so they don't go looking for a shortcut.