Grey market relay service disables OpenAI Codex and Claude Code sandboxes and reroutes enterprise data

Symantec reports that the relay's setup scripts (setup-codex.ps1 and setup-claudecode.ps1, run via iwr | iex or curl | bash) edit ~/.codex/config.toml and ~/.claude/settings.json to change the base URL, set sandboxmode to danger-full-access, enable write-sandbox network access and disable telemetry. Relay keys are stored as user-level environment variables, and one host ran claude /logout and /login. No CVE is involved. Defenders should hunt for changed baseurl or ANTHROPICBASEURL values, danger-full-access, unapproved OPENAIBASEURL, CODEXAPIKEY or ANTHROPICAUTHTOKEN variables, and in-memory download-and-execute commands soon after an npm install of these tools. They should also restrict AI tool traffic to approved endpoints and block the published relay domains and file hashes.

For security analysts · Written by AI from 2 sources · Wrong?