Symantec's Threat Hunter Team said on 29 October 2026 that it has identified an unauthorized relay service that provides access to OpenAI's Codex and Anthropic's Claude Code command-line coding agents, mainly in markets where the vendors do not officially operate, primarily mainland China.

Symantec says the service has been active since at least early 2026 and has impacted systems at a dozen organizations, most of them in mainland China, as well as multinational subsidiaries based in South Korea, Taiwan and Malaysia, in sectors including industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals and data center services.

According to Symantec, users run a fileless PowerShell or bash setup script, fetched from a lookalike domain by a one-line command, shortly after a legitimate npm install of the CLI; the script rewrites ~/.codex/config.toml or ~/.claude/settings.json to point at a relay-controlled domain, swaps in a relay-issued API key set as user-scope environment variables so the change survives a reboot, sets Codex's sandbox mode to "danger-full-access", enables network access for the write sandbox and disables telemetry and error reporting. On one host the script logged the user out of their Anthropic session and deleted the ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY variables before reissuing relay-controlled credentials.

Symantec says this is not a vulnerability in Codex or Claude Code, that there is no evidence so far that the relay operator has abused its access, but that a relay in this position sees every prompt, file and secret sent to the agent and, with the sandbox disabled, a malicious or compromised response could execute with the full privileges of the user's account.

Symantec says the relay's backend has rotated across at least eight domains impersonating OpenAI- or Anthropic-branded chat services, and it published indicators. (source: Symantec)