Shadowy AI Relay Service Disables Security Features in OpenAI and Claude Code Tools
An unofficial AI relay service is bypassing regional restrictions for OpenAI Codex and Anthropic Claude Code, but at the cost of disabling critical security sandboxes and rerouting user credentials.
A clandestine relay service is providing access to OpenAI's Codex and Anthropic's Claude Code AI tools in regions where they are officially unavailable. However, this service introduces significant security risks by disabling essential security features, including code sandboxing, potentially allowing malicious code to bypass safety checks.
The AI relay, first identified by the Symantec Threat Hunter Team, appears designed to circumvent geographical restrictions that prevent certain countries and regions from accessing AI platforms from US companies. The service installs genuine command-line interfaces (CLIs) for Codex and Claude Code on enterprise systems. It then reconfigures these tools to route requests through its own infrastructure rather than the official OpenAI or Anthropic networks. This activity has been observed since early 2026, with installations reported at a dozen organizations, primarily in mainland China, but also in South Korea, Taiwan, and Malaysia.
While the service provides access to the AI tools, it also critically disables their built-in security safeguards. Symantec researchers noted that the relay service turns off the CLIs' execution sandbox, a vital feature that limits the actions AI coding tools can perform. Additionally, the service enables network access for the write sandbox, disables telemetry and error reporting, and replaces user API credentials with its own issued tokens. In one observed instance, the script logged a user out of their Anthropic session and deleted their authentication variables before reissuing credentials under the relay service's control.
The motivations behind these dangerous configurations remain unclear, as no malware or malicious activity has been directly observed by Symantec. However, the researchers emphasize that the relay service creates substantial cyber risk for the organizations utilizing it. The disabling of sandboxes and the management of persistent credentials suggest a potential for malicious exploitation if the operators' intentions were to change.
Symantec researchers speculate that while bypassing regional restrictions is a plausible explanation, it doesn't necessitate disabling security features or establishing persistent credentials. The relay service's architecture could support malicious exploitation, allowing operators to view every prompt, file, and secret sent to the AI agent, and to alter or fabricate responses. With the sandbox disabled and network access enabled, a compromised response could execute with the full privileges of the user's account.
While the relay service's operators have not been observed abusing their access, the structure of the service allows for such actions. The Claude Code keys issued by the relay service are formatted in a way that Anthropic reserves for subscription-based OAuth tokens, suggesting the relay might be pooling flat-rate subscriptions and distributing capacity among multiple customers. However, the disabling of security features also hints at potential fraud operations involving stolen credentials or payment cards, or the malicious resale of prompts and files processed through the relay.
Symantec has provided indicators of compromise (IoCs) related to this activity, although no direct compromises have been confirmed. The report suggests that affected organizations are less likely to be targeted and more likely to be workplaces where individual employees sought out and used the service to gain access to desired tools. Nevertheless, the use of this service poses serious risks to corporate networks, and its appeal to regions lacking official access or to users seeking cheaper alternatives makes it a potential threat vector.
This situation highlights a growing concern around the security implications of unofficial access to powerful AI tools. As AI becomes more integrated into development workflows, ensuring the integrity and security of these tools, especially when accessed through unauthorized channels, becomes paramount for enterprise security.