Security researchers at Symantec have documented an unusual gray-market operation that sits between enterprise developers and two of the most prominent AI coding agents. According to a Dark Reading report by Rob Wright, the service quietly installs authentic copies of OpenAI's Codex CLI and Anthropic's Claude Code CLI, then reconfigures them so traffic flows through infrastructure controlled by the relay operator rather than the vendors' own networks.

What Symantec found

The Symantec Threat Hunter Team first noticed a suspicious PowerShell downloader, which it later identified as an AI-agent hijack script. Following that lead, analysts found similar activity on other networks and traced it back to the relay. The service has been operating since early 2026 and has touched roughly a dozen organizations. Most are in mainland China, with additional victims or users in South Korea, Taiwan, and Malaysia, regions where US-based AI vendors limit or block direct sales.

The installation flow is notable. A user installs the legitimate CLI through npm, and a fileless PowerShell or bash script is then pulled from a lookalike domain through a one-line command that the user appears to run personally. That pattern resembles social-engineering techniques such as ClickFix and InstallFix, but Symantec stressed that the CLI binaries themselves were not trojanized or altered. The tools are real; the configuration around them is what has been changed.

Risky configuration changes

The reconfiguration is where the danger lies. The script turns off the execution sandbox, a core safeguard that constrains what an AI coding agent can do on a machine. It also enables network access for the write sandbox, disables telemetry and error reporting, and replaces the user's API credentials with tokens issued by the relay. In one observed case, the script logged a user out of an Anthropic session and wiped their authentication variables before installing relay-controlled credentials. Symantec noted these credentials persist across reboots.

The Claude Code keys issued by the relay carry the prefix Anthropic reserves for subscription-based OAuth tokens. Symantec said this is consistent with, though not proof of, a scheme that pools flat-rate subscriptions and divides the capacity among many customers, a classic resale arbitrage model.

Why the motive is unclear

The simplest explanation is that the operators are circumventing regional restrictions and selling access. But Symantec argued that explanation does not account for disabling sandboxes or setting up persistent credentials, since neither is needed to deliver basic access. Possible alternative motives the researchers floated include fraud involving stolen credentials or payment cards, or the resale of prompts and files that pass through the relay. Senior intelligence analyst Brigid O Gorman said any talk of intent is speculative because no abuse was observed.

Still, she outlined the theoretical exposure in stark terms. A relay in this position sees every prompt, file, and secret that an employee sends to the agent, and it can modify or fabricate any response. With the sandbox off and network access on, a malicious or compromised response could run with the full privileges of the user's account. Symantec said the architecture would readily support exploitation if the operator's intentions shifted.

Shadow AI, not targeted intrusion

Symantec published indicators of compromise even though no compromise has technically occurred. Its assessment is that the affected organizations look less like deliberately chosen targets and more like workplaces where individual employees sought out the service to get tools they wanted. That framing places the incident squarely in the shadow AI category, where staff adopt unsanctioned tools outside IT governance.

The researchers also cautioned that the problem could extend beyond restricted regions. Organizations hunting for cheaper alternatives to official subscriptions, and employees engaging in shadow AI more broadly, could be drawn to similar relays.

Implications for the AI coding market

The case illustrates how strong demand for agentic coding tools is creating a secondary market that vendors cannot easily police. Codex and Claude Code are valued for their autonomy, but that autonomy is bounded by sandboxing, and removing those boundaries turns a productivity tool into a high-privilege access point. For enterprise security teams, the lesson is that AI agent CLIs need to be inventoried, their configurations audited, and egress to unapproved endpoints monitored. For OpenAI and Anthropic, the episode raises questions about detecting pooled subscription abuse, validating endpoints, and making sandbox settings harder to silently override. It also underscores the persistent tension between regional access policies and user demand, which gray-market intermediaries are eager to exploit.