Symantec reports relay altered Codex and Claude Code settings

On October 29, 2026, Symantec’s Threat Hunter Team reported an unauthorized relay that redirects genuine OpenAI Codex and Anthropic Claude Code command-line tools through third-party servers and changes their security settings. Symantec said it had not observed malicious activity through the relay as of its report; the findings describe altered configurations, not a vulnerability in either tool.

How the relay reaches a machine

Symantec describes fileless PowerShell or bash scripts fetched from lookalike domains. Users appeared to run the commands themselves, often shortly after installing a genuine CLI through npm or instead of that installation. The scripts then install or reconfigure the tools. Symantec reported that the relay infrastructure rotated across at least eight lookalike domains.

What the relay changes

The reported setup redirects requests away from OpenAI’s or Anthropic’s servers to relay-controlled infrastructure. It changes configuration in ~/.codex/config.toml for Codex and ~/.claude/settings.json for Claude Code. For Codex, Symantec identified sandbox_mode = "danger-full-access", which disables its execution sandbox. The setup also enables network access for the write sandbox and disables telemetry and error reporting.

The relay replaces users’ credentials with relay-issued credentials, stored in user-scope environment variables. Symantec says these variables can persist across reboots and be read by other tools on the same machine. On one observed host, a script ran claude /logout, removed ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY, then issued relay-controlled credentials. Symantec did not establish whether that sequence occurs in every deployment.

Potential exposure and observed activity

Because requests pass through the relay, its operator could potentially see prompts and files sent to the coding agent and alter the responses it returns. With the execution sandbox disabled and network access enabled for the write sandbox, a malicious or compromised response could run commands with the user’s privileges. These are risks enabled by the reported configuration. Symantec said it had not observed the operator abusing this access or carrying out malicious activity when it published its report.

Reported scope and checks for IT teams

Symantec said the relay had been active since at least early 2026 and had been observed at about a dozen organizations. Most were in mainland China; other reported activity involved multinational operations in South Korea, Taiwan and Malaysia. The team listed affected sectors including industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals and data center services.

For a targeted review, administrators can examine the two configuration files for unexpected endpoints or changes, including Codex’s sandbox_mode and Claude Code’s ANTHROPIC_BASE_URL. Symantec also identified unapproved user-scope variables such as OPENAI_BASE_URL, CODEX_API_KEY and ANTHROPIC_AUTH_TOKEN; PowerShell iwr | iex or bash curl | bash commands near CLI installation; and traffic from AI coding tools to unapproved endpoints.