Based on information from Dark Reading, a mysterious relay service is installing unauthorized versions of OpenAI Codex and Anthropic Claude Code tools for enterprise users, creating significant security vulnerabilities.
The Symantec Threat Hunter Team identified a service that bypasses regional restrictions for AI tools by routing requests through its own infrastructure. Active since early 2026, the service has been detected in 12 organizations across mainland China, South Korea, Taiwan and Malaysia. While the tools themselves are genuine, the relay service reconfigures them by disabling execution sandboxes, turning off telemetry and replacing user credentials with relay-issued tokens. By intercepting traffic, the service gains the ability to view prompts, files and secrets sent by employees. Although researchers have not yet observed direct malicious exploitation, the potential for data theft or unauthorized code execution remains high. The service appears to target employees seeking access to restricted tools rather than specific corporate networks. Experts warn that this shadow AI activity creates severe risks, as the relay operator maintains the capability to alter responses or execute commands with the full privileges of the user account. Organizations are urged to monitor for suspicious PowerShell scripts and unauthorized CLI configurations to mitigate these emerging threats.
Source: Dark Reading
