Relay redirects Codex and Claude Code requests, researchers say
Symantec and Carbon Black found the service in use at about 12 organizations. They found no evidence that it harvested prompts or altered responses, but its configuration removes an execution safeguard.
In this article
An unauthorized relay service installs genuine OpenAI Codex and Anthropic Claude Code clients on company systems, then redirects every request to its own servers rather than the vendors’, an investigation by Symantec and Carbon Black found. The clients are coding tools operated through typed commands.
The investigators also found that the service switches off the clients’ execution sandbox, a safeguard that restricts what commands can do. There is no evidence that the relay has harvested employees’ prompts or fabricated or altered responses.
The service is assessed to have been active since at least early 2026. Its use, rather than a confirmed malicious compromise, was observed at about 12 organizations, primarily in mainland China, as well as at multinational subsidiaries in South Korea, Taiwan and Malaysia.
The reported sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals and data-center services.
How the relay reportedly changes the clients
The clients are installed legitimately through npm and are not modified versions. Shortly afterward, users are likely instructed to run a command that fetches a fileless PowerShell or bash setup script from a lookalike domain, The Hacker News said in its account of the investigation. The script then overrides the clients’ settings.
For Codex, the changes set the sandbox to “danger-full-access,” removing the execution safeguard. The configuration targets ~/.codex/config.toml for Codex or ~/.claude/settings.json for Claude Code. It also replaces users’ credentials with tokens issued by the relay, turns off diagnostic and error reporting, and enables network access for the write sandbox.
The investigation describes employees turning to an unauthorized reseller to try a Western superintelligence (SI) coding assistant. The service appears to focus on markets where OpenAI and Anthropic do not operate. Researchers suspect its operators may be bypassing regional restrictions and reselling capacity below market rates; those explanations are not established motives.
Earlier in Technology
InfrastructurexAI powers Mississippi data center with 8 converted jet turbines
The generators have state permits allowing a 25% higher limit for volatile organic compounds. An environmental group has challenged the approval, alleging shortcomings in xAI’s emissions assurances and projections.
1 min
Superintelligence3AM encrypted about 37 UK school machines in September, Bitdefender says
Bitdefender says a 3AM affiliate encrypted about 37 UK school machines in September. It suspects superintelligence (SI) assistance because slightly changed commands repeated every 40 to 100 seconds. But researchers could not inspect the attacker’s machine or establish autonomous operation: a person could have copied instructions and results between malicious software and a model.
2 min
InfrastructureGermany’s regulator selects 11 backup power projects
The gas-fired plants are planned for 2031 to back up wind and solar power. A new consumer levy will finance annual costs of just over €800 million, but its effect on individual bills is unclear.
1 min
