--- title: Shadowy AI Relay Disables OpenAI Codex, Claude Code... description: A relay service is installing genuine OpenAI Codex and Anthropic Claude Code CLIs for enterprise users in regions where these tools aren't officially sold,... canonical: https://daily.dev/posts/shadowy-ai-relay-disables-openai-codex-claude-code-sandboxes-5f7yk3dwa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes | daily.dev og:description: A relay service is installing genuine OpenAI Codex and Anthropic Claude Code CLIs for enterprise users in regions where these tools aren't officially sold,... og:url: https://daily.dev/posts/shadowy-ai-relay-disables-openai-codex-claude-code-sandboxes-5f7yk3dwa og:image: https://api.daily.dev/og/posts/5f7YK3Dwa.png og:image:alt: Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary A relay service is installing genuine OpenAI Codex and Anthropic Claude Code CLIs for enterprise users in regions where these tools aren't officially sold, then disabling their security safeguards. Symantec's Threat Hunter Team found the service active since early 2026 at a dozen organizations, mostly in mainland China, plus South Korea, Taiwan, and Malaysia. The relay turns off execution sandboxes, enables network access for the write sandbox, disables telemetry, and swaps in its own relay-issued API credentials. No malicious activity has been confirmed, but with sandboxes off, a malicious or compromised response could run with full user privileges. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the unauthorized AI relay service do to OpenAI Codex and Claude Code CLIs? It installs genuine Codex and Claude Code CLIs but reconfigures them to route requests through its own infrastructure instead of OpenAI's or Anthropic's. It disables the execution sandbox, enables network access for the write sandbox, turns off telemetry and error reporting, and replaces user API credentials with relay-issued tokens, all discovered by Symantec's Threat Hunter Team active since early 2026. _Teams evaluating AI coding tool rollouts can track emerging supply-chain risks like this on daily.dev._ ### Why is disabling the Claude Code or Codex sandbox risky even without confirmed malware? With the sandbox disabled and network access enabled, a malicious or compromised response could execute with the full privileges of the user's account. A relay in this position can see every prompt, file, and secret sent to the agent and can alter or fabricate every response it returns, creating risk even absent observed malicious activity. _Developers weighing AI agent sandbox settings can follow security writeups like this on daily.dev._ ### Which regions were affected by the unauthorized Codex and Claude Code relay service? A dozen organizations were affected, primarily in mainland China, with additional cases in South Korea, Taiwan, and Malaysia. The relay appears designed to bypass regional restrictions preventing these markets from officially purchasing OpenAI and Anthropic products. _Enterprises tracking regional AI tool access risks can follow incident reports like this on daily.dev._ ## Similar posts on daily.dev - [How AI Coding Tools Crushed the Endpoint Security Fortress](https://daily.dev/posts/how-ai-coding-tools-crushed-the-endpoint-security-fortress-oivfawpcr) · Dark Reading · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#claude-code](https://daily.dev/tags/claude-code), [#ai-security](https://daily.dev/tags/ai-security), [#openai-codex](https://daily.dev/tags/openai-codex) [View this post on daily.dev](https://daily.dev/posts/shadowy-ai-relay-disables-openai-codex-claude-code-sandboxes-5f7yk3dwa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes","url":"https://daily.dev/posts/shadowy-ai-relay-disables-openai-codex-claude-code-sandboxes-5f7yk3dwa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/shadowy-ai-relay-disables-openai-codex-claude-code-sandboxes-5f7yk3dwa"},"datePublished":"2026-10-29T10:02:42.376Z","dateModified":"2026-10-29T10:03:19.020Z","description":"A relay service is installing genuine OpenAI Codex and Anthropic Claude Code CLIs for enterprise users in regions where these tools aren't officially sold,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9d191039b460f397bcb05d97cc9bfedb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9d191039b460f397bcb05d97cc9bfedb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/shadowy-ai-relay-disables-openai-codex-claude-code-sandboxes-5f7yk3dwa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,claude-code,ai-security,openai-codex","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/shadowy-ai-relay-disables-openai-codex-claude-code-sandboxes-5f7yk3dwa#faq","mainEntity":[{"@type":"Question","name":"What does the unauthorized AI relay service do to OpenAI Codex and Claude Code CLIs?","acceptedAnswer":{"@type":"Answer","text":"It installs genuine Codex and Claude Code CLIs but reconfigures them to route requests through its own infrastructure instead of OpenAI's or Anthropic's. It disables the execution sandbox, enables network access for the write sandbox, turns off telemetry and error reporting, and replaces user API credentials with relay-issued tokens, all discovered by Symantec's Threat Hunter Team active since early 2026. Teams evaluating AI coding tool rollouts can track emerging supply-chain risks like this on daily.dev."}},{"@type":"Question","name":"Why is disabling the Claude Code or Codex sandbox risky even without confirmed malware?","acceptedAnswer":{"@type":"Answer","text":"With the sandbox disabled and network access enabled, a malicious or compromised response could execute with the full privileges of the user's account. A relay in this position can see every prompt, file, and secret sent to the agent and can alter or fabricate every response it returns, creating risk even absent observed malicious activity. Developers weighing AI agent sandbox settings can follow security writeups like this on daily.dev."}},{"@type":"Question","name":"Which regions were affected by the unauthorized Codex and Claude Code relay service?","acceptedAnswer":{"@type":"Answer","text":"A dozen organizations were affected, primarily in mainland China, with additional cases in South Korea, Taiwan, and Malaysia. The relay appears designed to bypass regional restrictions preventing these markets from officially purchasing OpenAI and Anthropic products. Enterprises tracking regional AI tool access risks can follow incident reports like this on daily.dev."}}]} ```