Sandbox Flipped to ‘Danger-Full-Access’: Unauthorized AI Relays Create Risk for Organizations

An unauthorized relay service has been observed reconfiguring legitimate OpenAI Codex and Anthropic Claude Code CLI tools on enterprise systems to route traffic through third-party infrastructure, disabling sandbox protections and replacing user API credentials with relay-controlled tokens. The attack relies on fileless PowerShell or bash scripts delivered via lookalike domains, which users execute manually after installing the official CLIs via npm. The reconfigured tools allow full access to prompts, files, and system commands, posing significant security risks even though no abuse has been observed yet. The activity has impacted organizations primarily in mainland China and parts of Asia across sectors including industrial automation, semiconductors, and petrochemicals.

AI-extracted · verify before operational use