A clandestine relay service is leveraging genuine OpenAI Codex and Claude Code tools to compromise enterprise data security. This service modifies configurations, routing all data through its controlled servers. Since early 2026, it has impacted about a dozen companies, primarily in mainland China, including subsidiaries of South Korean, Taiwanese, and Malaysian firms.
Industries at Risk
Industries affected by this relay service span several sectors, including industrial automation, electronics, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data center services. Employees in these sectors often resort to resellers for AI tools due to restrictions on direct purchases, inadvertently exposing themselves to security threats.
Symantec’s Threat Hunter Team identified the relay service and explained its operation in a recent report. They clarified that the issue arises not from flaws in the AI tools themselves but from unauthorized configuration changes.
Mechanism of the Relay Service
The relay service does not deploy fake software. Instead, users install the legitimate tools using a standard npm command. Shortly after, a one-line command downloads a setup script from a lookalike domain, executing in memory without leaving a trace. This script ensures the presence of Node.js and the relevant AI tool, appearing routine to users and most monitoring tools.
The script alters configuration files for Codex and Claude Code, redirecting base URLs to domains the relay controls and embedding a relay-issued API key as a persistent environment variable. This setup disables the sandbox mode, enabling full network access and concealing usage from original developers.
Security Implications
The relay’s position allows it to intercept and manipulate any data sent to the AI tools, posing significant security risks. Although Symantec has not observed malicious exploitation of these capabilities, the potential for misuse exists. Credentials exposed by this setup can be accessed by any program on the same device, amplifying the risk.
The motivations behind these unauthorized actions remain unclear. While bypassing regional restrictions is a possible motive, the need to disable security features suggests more complex objectives, potentially involving fraud or data resale.
Protecting Enterprise Systems
Organizations should monitor systems utilizing these AI tools for specific indicators of compromise, such as changes to configuration files and unauthorized environment variable settings. Limiting tool traffic to sanctioned AI service endpoints can mitigate risks. Symantec advises using endpoint protection products to block malicious files once detected.
In conclusion, vigilance and proactive threat intelligence integration are critical for safeguarding enterprise data against unauthorized AI tool exploitation. Organizations must remain alert to evolving threats and implement robust security measures to protect their digital assets.
