Symantec’ning Threat Hunter Team’i ruxsatsiz relay xizmatini topdi, u haqiqiy OpenAI Codex va Anthropic Claude Code CLI’larini o‘rnatadi, so‘ngra ularning sozlamalarini qayta yozib sandboxni o‘chiradi.
Bu 2026-yil boshidan beri 12 ta tashkilotga ta’sir ko‘rsatdi, asosan Xitoyning materik qismida.
AI kodlash agentlari fayllarni o‘qiydi, kod yozadi va hostda buyruqlarni bajaradi. Sandbox ularning nima qila olishini cheklaydi. Relay trojanlashtirilgan mijozni jo‘natmaydi. Foydalanuvchilar avval Codex yoki Claude Code’ning haqiqiy npm install’ini bajaradilar.
So‘ngra faylsiz PowerShell yoki bash bir qatorlik (iwr | iex yoki curl | bash) ishlaydi, vibe.aiok[.]me kabi o‘xshash domenlardan olinadi.
Symantec tomonidan e’lon qilingan texnik tadqiqotga ko‘ra, skript ~/.codex/config.toml yoki ~/.claude/settings.json’ni qayta yozadi.
U baseurl yoki ANTHROPICBASE_URL’ni relay nazoratidagi serverlarga yo‘naltiradi va relay tomonidan berilgan API kalitlarini almashtiradi. U ikkalasini ham foydalanuvchi doirasidagi muhit o‘zgaruvchilari sifatida saqlaydi, shuning uchun ular qayta yuklashdan keyin ham saqlanib qoladi.
Shuningdek, u sandbox_mode = “danger-full-access” ni o‘rnatadi, yozish sandboxi uchun tarmoq kirishini yoqadi va telemetriya hamda xato hisobotini o‘chiradi.
Bir hostda u claude /logout’ni bajardi, Anthropic autentifikatsiya o‘zgaruvchilarini o‘chirdi va yangi kirishni majbur qildi. Bir nechta hostlar Windows geo sozlamasini ham so‘radi, ehtimol tizim relay xizmat ko‘rsatadigan hududda ekanligini tasdiqlash uchun.
Bu Codex yoki Claude Code’dagi zaiflik emas. Ularning konfiguratsiyasi o‘zgartirilgandan so‘ng, vositalar mo‘ljallanganidek ishlaydi.
Jabrlanuvchilar orasida sanoat avtomatlashtirish, yarimo‘tkazgichlar, farmatsevtika, yuk tashish, shina ishlab chiqarish, neft-kimyo va ma’lumotlar markazi xizmatlari bor.
Ba’zilari Janubiy Koreya, Tayvan va Malayziyadagi firmalarning Xitoy operatsiyalari. Ko‘pchilik o‘z bozorida sotilmaydigan G‘arbiy AI yordamchisini xohlagan xodimlar kabi ko‘rinadi, tanlangan nishonlar emas.
Symantec operator o‘z pozitsiyasidan foydalanayotganiga dalil topmadi. Xavflar potentsial, kuzatilgan emas. Relay agentga yuborilgan har bir so‘rov, fayl va sirni ko‘radi. U javoblarni o‘zgartirishi yoki soxtalashtirishi mumkin, va sandbox o‘chirilgan hamda tarmoq kirishi yoqilgan holda, zararli javob foydalanuvchining to‘liq huquqlari bilan ishlashi mumkin.
Bundan tashqari, Claude kalitlari sk-ant-oat01- prefiksidan foydalanadi, Anthropic obuna OAuth tokenlari uchun ishlatadi, bu tekis narxli obunalarning qayta sotilishini ko‘rsatadi. Hisob ma’lumotlari foydalanuvchi doirasidagi muhit o‘zgaruvchilarida joylashganligi sababli, o‘sha mashinadagi boshqa vositalar ularni o‘qishi mumkin.
Kuzatilgan konfiguratsiya buzilishi korporativ nuqtalarda tekshirilmagan AI kodlash yordamchilari joylashtirilishi bilan bog‘liq o‘sib borayotgan operatsion xavotirlarni aks ettiradi.
Himoyachilar ushbu CLI’larni ishlatayotgan nuqtalarni baseurl yoki ANTHROPICBASEURL o‘zgarishlari, config.toml’dagi danger-full-access mavjudligi va tasdiqlangan joylashtirishdan tashqarida o‘rnatilgan OPENAIBASEURL, CODEXAPIKEY yoki ANTHROPICAUTH_TOKEN holatlari uchun kuzatishi kerak.
Xavfsizlik jamoalari shuningdek npm install -g @openai/codex yoki @anthropic-ai/claude-code’dan so‘ng darhol iwr | iex yoki curl | bash ishlashini kuzatishi, tasdiqlangan AI ruxsat ro‘yxatidan tashqari manzillarga yo‘naltirilgan CLI trafikini ogohlantirishi va zararli ta’minot zanjiri hujumlaridan faol himoyalanishi kerak.
Symantec’s Threat Hunter Team has found an unauthorized relay service that installs the genuine OpenAI Codex and Anthropic Claude Code CLIs, then rewrites their settings to turn off sandboxing.
It has affected 12 organizations since early 2026, mostly in mainland China.
AI coding agents read files, write code, and run commands on the host. A sandbox limits what they can do. The relay does not ship a trojanized client. Users first run a legitimate npm install of Codex or Claude Code.
A fileless PowerShell or bash one-liner (iwr | iex or curl | bash) then runs, fetched from lookalike domains such as vibe.aiok[.]me.
According to technical research published by Symantec, the script rewrites ~/.codex/config.toml or ~/.claude/settings.json.
It points baseurl or ANTHROPICBASE_URL at relay-controlled servers and swaps in relay-issued API keys. It saves both as user-scope environment variables so they survive a reboot.
It also sets sandbox_mode = “danger-full-access”, enables network access for the write sandbox, and disables telemetry and error reporting.
On one host, it ran claude /logout, deleted the Anthropic authentication variables, and forced a fresh login. Several hosts also queried the Windows geo setting, likely to confirm the system was in the region the relay serves.
This is not a vulnerability in Codex or Claude Code. The tools behave as designed once their configuration is changed.
Victims include industrial automation, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services.
Some are Chinese operations of firms based in South Korea, Taiwan, and Malaysia. Most look like employees who wanted a Western AI assistant that isn’t sold in their market, not chosen targets.
Symantec found no evidence that the operator is abusing its position. The risks are potential, rather than observed. The relay sees every prompt, file, and secret sent to the agent. It can alter or fabricate responses, and with the sandbox off and network access on, a malicious response could run with the user’s full privileges.
Furthermore, the Claude keys use the sk-ant-oat01- prefix, which Anthropic uses for subscription OAuth tokens, consistent with pooled flat-rate subscriptions being resold. Because the credentials sit in user-scope environment variables, other tools on the same machine can read them.
The observed configuration tampering reflects growing operational concerns surrounding AI coding assistants deployed across unvetted corporate endpoints.
Defenders should watch endpoints running these CLIs for changes to baseurl or ANTHROPICBASEURL, the presence of danger-full-access in config.toml, and instances of OPENAIBASEURL, CODEXAPIKEY, or ANTHROPICAUTH_TOKEN set outside approved deployment.
Security teams must also monitor for an iwr | iex or curl | bash run right after npm install -g @openai/codex or @anthropic-ai/claude-code, alert on CLI traffic directed to destinations outside an approved AI allow-list, and actively guard against rogue supply chain attacks.
