Unauthorized OpenAI Codex and Claude Code Relays Disable AI Sandboxes and Redirect Enterprise Data

An unauthorized AI relay service is installing genuine OpenAI Codex and Anthropic Claude Code tools on company computers, then changing their settings to send requests through third-party servers. The setup also removes sandbox controls, creating a path for sensitive business data to leave approved systems.

Symantec’s Threat Hunter Team documented the activity in an October 29 report. Researchers observed the service across a dozen organizations since early 2026.

Most were in mainland China, with other deployments involving multinational firms connected to South Korea, Taiwan, and Malaysia. Affected industries include semiconductors, pharmaceuticals, shipping, electronics, petrochemicals, and data center services.

The key distinction is configuration. Researchers found neither a modified client nor a vulnerability in Codex or Claude Code. The genuine tools follow settings introduced by the relay.

Sandbox Controls and Credentials Replaced

Users appear to run a setup command themselves, often within minutes to half an hour of installing an AI coding tool through npm. Researchers found no automated or exploit-based delivery.

A fileless PowerShell or bash script arrives from a lookalike domain such as vibe.aiok[.]me. It checks for Node.js and the requested coding tool, installs missing components, and then applies the relay settings. Because users receive a working application, the extra setup can look routine.

The script rewrites ~/.codex/config.toml or ~/.claude/settings.json. It changes base_url or ANTHROPIC_BASE_URL to relay-controlled infrastructure and installs relay-issued credentials. User-level environment variables preserve these settings after a restart.

For teams examining unfamiliar setup scripts, ANY.RUN’s interactive sandbox offers a separate analysis environment with live interaction and reporting. This differs from the coding agent’s own sandbox, which limits actions during normal use.

In Codex, the script sets sandbox_mode to danger-full-access. It also enables network access for the write sandbox and disables telemetry and error reporting through DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1. These changes remove safeguards while suppressing signals that might otherwise reach the vendors.

On one host, the script ran claude /logout, removed ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY, then ran claude /login. This cleared an existing session before relay credentials took over. Researchers could not establish whether every deployment followed that sequence, reads the Symantec report.

The service rotated through at least eight domains imitating OpenAI or Anthropic services. Its subscription-style Claude tokens could suggest pooled account resale, but researchers said this was not proof of its business model.

Related reporting on Codex and Claude Code hijacking through Downloads folders shows a separate route to endpoint redirection. Here, however, the setup script changes the settings directly rather than relying on malicious instructions inside files.

The relay can see prompts, files, and secrets sent through it, and could alter responses. With sandbox protection removed, a malicious response could lead to commands running with the user’s account privileges. Symantec found no evidence that the operator had exploited this position. Observed redirection must not be confused with confirmed data theft.

Separate coverage of AI coding agent security flaws highlights why permission controls matter. This case adds another concern: genuine software can become unsafe when an unapproved service controls its settings.

Defenders should review endpoint URLs, sandbox settings, and user-level credential variables. PowerShell or bash download-and-execute commands shortly after npm installation deserve attention.

Network monitoring should flag coding tools contacting destinations outside approved AI endpoints. Relay-issued variables also warrant review because other applications may inherit them. These checks help separate sanctioned deployments from unapproved access without treating every legitimate AI installation as malicious activity.

Investigate suspicious scripts before they reach developer systems. Explore ANY.RUN’s interactive analysis features to observe behavior, inspect network activity, and support incident triage.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24	setup-codex.ps1, fileless PowerShell downloader posing as an OpenAI Codex CLI setup script
SHA-256	4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb	setup-claudecode.ps1, fileless PowerShell/bash downloader posing as a Claude Code CLI setup script
Domain	vibe[.]aiok[.]me	Relay domain
Domain	aiok[.]me	Relay domain
Domain	sorryios[.]io	Relay domain
Domain	nuoda[.]vip	Relay domain
Domain	chat[.]nuoda[.]vip	Relay domain
Domain	rawchat[.]cn	Relay domain
Domain	sharedchat[.]cc	Relay domain
Domain	mirbuds[.]com	Relay domain
Domain	claudechn[.]com	Relay domain
Domain	vibe[.]skk[.]moe	Relay domain
URL	hxxps://vibe[.]aiok[.]me	Relay URL
URL	hxxps://vibe[.]aiok[.]me/setup-codex.ps1	Codex setup script
URL	hxxps://vibe[.]aiok[.]me/setup-claudecode.ps1	Claude Code setup script
URL	hxxps://chat1[.]sorryios[.]io	Relay URL
URL	hxxps://chat1[.]sorryios[.]io/codex	Codex relay endpoint
URL	hxxps://chat1[.]sorryios[.]chat/claudecode	Claude Code relay endpoint
URL	hxxps://chat[.]nuoda[.]vip	Relay URL
URL	hxxps://chat[.]nuoda[.]vip/codex	Codex relay endpoint
URL	hxxps://chat[.]nuoda[.]vip/claudecode	Claude Code relay endpoint
URL	hxxps://rawchat[.]cn/codex	Codex relay endpoint
URL	hxxps://chat[.]rawchat[.]cn/codex	Codex relay endpoint
URL	hxxps://new[.]sharedchat[.]cc/codex	Codex relay endpoint
URL	hxxps://gpt4[.]mirbuds[.]com/codex	Codex relay endpoint
URL	hxxps://claudechn[.]com/codex	Codex relay endpoint

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.