Unauthorized Relay Service Disables AI CLI Sandboxes and Routes Traffic Through Attacker Servers
What Happened — Symantec’s Threat Hunter team discovered a covert “relay” service that hijacks legitimate OpenAI Codex and Anthropic Claude Code command‑line tools after they are installed via npm. The relay delivers a file‑less PowerShell or Bash script from a look‑alike domain; the script re‑writes the CLI configuration to turn off the built‑in sandbox (“danger‑full‑access”), swaps the user’s API keys for attacker‑issued tokens, and forces all requests to flow through the relay’s own infrastructure. The activity has been observed in at least a dozen organizations across industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data‑center services—primarily in mainland China, with subsidiaries in South Korea, Taiwan, and Malaysia. No abuse has been confirmed yet, but the altered settings would allow the relay operator to read every prompt, file, and secret processed by the AI agents and execute commands with the user’s full privileges.
Why It Matters for Trust & Control Assurance — The episode highlights the need for robust configuration‑management and third‑party software oversight controls; without continuous monitoring, a malicious relay can silently subvert trusted AI tools.
Who Is Affected — Industrial automation, electronics & semiconductor manufacturers, pharma, logistics, data‑center operators, and any enterprise that adopts AI coding assistants via open‑source package managers.
Recommended Actions
- Inventory all installed AI‑coding CLIs and verify that sandbox settings remain enabled.
- Enforce strict change‑control policies for any post‑install scripts; block execution of one‑line remote fetch commands.
- Rotate and protect API credentials; use secret‑management solutions that detect unauthorized replacement.
- Deploy continuous monitoring that flags configuration drift or unknown outbound connections from AI agents.
- Incorporate third‑party risk assessments for any external services that modify vendor‑supplied software.
Technical Notes
- Attack vector: File‑less PowerShell/Bash script fetched from look‑alike domain (misconfiguration/third‑party dependency).
- Data at risk: API keys, source code, proprietary files, and any secrets passed to the AI agents.
- Tools impacted: OpenAI Codex CLI, Anthropic Claude Code CLI (installed via npm).
- Timeline: Activity observed since early 2026; still active.