Case rogue-codex-claude-code-relaysAI supply chainChina
Unauthorized Codex and Claude Code relays disable sandboxing at 12 organizations
Symantec says an unauthorized relay service installs the genuine OpenAI Codex and Anthropic Claude Code CLIs, then reconfigures them to route prompts and credentials through third-party servers with sandboxing switched off. It has been active since at least early 2026 and has affected a dozen organizations, mostly in mainland China, plus multinational subsidiaries in South Korea, Taiwan and Malaysia.
MediumAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 29, 2026
- Location
- China
- Target
- Users of Codex and Claude Code CLIs, mostly in mainland China
- Severity
- Medium
- Verification
- Reported by credible press or researchers
- Triggered by
- Unknown
- Actor type
- Unknown
- Sector
- Multiple / cross-sector
- Reported loss
- None reported
- CVE
- None
What happened
Symantec says an unauthorized relay service installs the genuine OpenAI Codex and Anthropic Claude Code CLIs, then reconfigures them to route prompts and credentials through third-party servers with sandboxing switched off. It has been active since at least early 2026 and has affected a dozen organizations, mostly in mainland China, plus multinational subsidiaries in South Korea, Taiwan and Malaysia.
Impact: At least 12 organizations, mostly in mainland China, have had coding-agent sandboxing disabled since early 2026. Data loss is not stated.
Who triggered it
Actor: Unknown
Attribution: Found by Symantec's Threat Hunter Team; the operator of the relay service is not identified in the summary.
Motive: Unknown
How it happened
Attack vector: Unauthorized relay service that installs genuine AI coding CLIs and rewrites their configuration to disable sandbox protections.
Root cause: Users install AI coding agents through an untrusted relay that silently weakens the tools' built-in security settings.
Timeline
- Reported by GBHackers
Response
Symantec's Threat Hunter Team disclosed the findings. No other response is described.
Current status: Ongoing
Research warnings this case matches
- Seen in real incidents AI systems themselves become targets · International AI Safety Report
- Seen in real incidents Privacy and security · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- GBHackers gbhackers.com
- Symantec (security.com) security.com
- Cyberpress cyberpress.org
Cite this case
Unauthorized Codex and Claude Code relays disable sandboxing at 12 organizations. AI Threat Watch, case rogue-codex-claude-code-relays, Oct 29, 2026. https://aithreat.io/cases/rogue-codex-claude-code-relays/
Permanent link: https://aithreat.io/cases/rogue-codex-claude-code-relays/
Related cases
The same type of incident, most recent first.