Symantec Documents Unauthorized Relays That Weaponize Genuine Codex and Claude Code Through Config Files
Attackers install legitimate AI coding tools, then rewrite configuration to redirect traffic through relay servers — no malware, no CVE, only malicious settings.
Symantec's Threat Hunter Team has documented unauthorized relay services that install genuine copies of OpenAI Codex and Claude Code on corporate machines, then tamper with configuration files such as ~/.codex/config.toml and ~/.claude/settings.json. The base_url is redirected to relay infrastructure, credentials are swapped for relay tokens, Codex's sandbox is set to danger-full-access, and telemetry is disabled. On one host, a Claude session was logged out and re-authenticated with a relay token.
There is no exploit in the traditional sense: victims themselves run setup scripts — PowerShell or bash fetched from lookalike domains — often minutes after installing the tools via npm. Symantec has documented the pattern in roughly 12 organizations since early 2026, mostly in mainland China plus multinationals linked to Korea, Taiwan and Malaysia, spanning semiconductors, pharmaceuticals and petrochemicals. The economic motive appears to be distillation and LLM jacking — reselling stolen API access.
Because the software itself is legitimate and unmodified, signature-based detection will not catch it. Symantec's findings point organizations toward configuration monitoring and egress-traffic controls rather than antivirus alone.