Shadowy AI Relay Disables OpenAI Codex and Anthropic Claude for China, Stripping Security Controls
What Happened — A previously unknown “AI relay” service is re‑hosting OpenAI’s Codex and Anthropic’s Claude code‑generation models and making them accessible from mainland China and other regions where the vendors do not officially sell the products. According to Dark Reading, the relay strips out key security mechanisms that the original providers embed in the APIs—such as content‑filtering, usage‑monitoring, and safety‑guardrails—so that end‑users receive unfiltered code suggestions. The service operates as a man‑in‑the‑middle proxy, forwarding requests to the official endpoints but returning the raw model output. No public breach of data has been reported, but the removal of safety controls creates a clear risk of malicious code generation, intellectual‑property leakage, and regulatory non‑compliance for organizations that consume the altered APIs.
Why It Matters for Trust & Control Assurance — The episode highlights a supply‑chain control gap: without continuous oversight of third‑party AI providers, organizations may inadvertently rely on services that disable essential security safeguards.
Who Is Affected —
- Technology and SaaS firms that embed AI coding assistants into developer tools.
- Enterprises across sectors that have adopted OpenAI Codex or Claude for internal software development.
Recommended Actions —
- Inventory every AI model or service used across your environment.
- Verify that each provider’s security and safety controls are enabled and documented.
- Add AI‑related vendors to your third‑party risk management program and require attestations that no security features are altered.
- Deploy network‑level monitoring to detect traffic to undocumented relay endpoints.
Source: Dark Reading
Technical Notes — The relay disables OpenAI’s content‑filtering and usage‑logging layers and Anthropic’s safety‑guardrails, effectively exposing raw model output. No CVE is associated; the risk stems from a malicious third‑party dependency rather than a software flaw.
Source: Dark Reading