[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqa8PagpcrlC7K4X_5BCTB7OC572RXyfcSmlwcsokDy4":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"3475da1c-4e35-4001-88d4-7614e51406e3","Unauthorized OpenAI Codex and Claude Code Relays Disable AI Sandboxes and Redirect Enterprise Data","unauthorized-openai-codex-and-claude-code-relays-disable-ai-sandboxes-and-redire-392056","A grey market relay service is quietly installing the real OpenAI Codex and Anthropic Claude Code tools on company computers. It then changes their settings so that every prompt, file and login token goes through servers the service controls. The service has been active since at least early 2026 and has touched about a dozen […] The post Unauthorized OpenAI Codex and Claude Code Relays Disable AI Sandboxes and Redirect Enterprise Data appeared first on Cyber Security News.","A grey market relay service is compromising enterprise AI tools like OpenAI Codex and Anthropic Claude Code by installing them and reconfiguring them to route all prompts, files, and login tokens through controlled servers. This service, active since early 2026, primarily targets organizations in mainland China and has affected companies across various industrial sectors. The attackers disable security features like sandboxing and telemetry, potentially exposing sensitive enterprise data.","Grey market relays install real AI tools, redirecting enterprise data and disabling sandboxes.","https:\u002F\u002Fcybersecuritynews.com\u002Funauthorized-openai-codex\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FUnauthorized-OpenAI-Codex-and-Claude-Code-Relays-Disable-AI-Sandboxes-and-Redirect-Enterprise-Data.webp","2026-10-30T08:50:24+00:00","2026-10-30T09:00:17.462596+00:00",8,[17,20,22,25],{"name":18,"type":19},"OpenAI Codex","product",{"name":21,"type":19},"Anthropic Claude Code",{"name":23,"type":24},"OpenAI","vendor",{"name":26,"type":24},"Anthropic","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":27,"icon":29,"name":30,"slug":31},null,"Threat Intelligence","threat-intelligence",[33,38,43,48],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":27,"icon":29,"name":30,"slug":31},[51],{"type":52,"value":53,"context":54},"domain","vibe.aiok[.]me","Lookalike domain used to pull setup scripts for the relay service.",[23,26,18],{"controls":57,"vendors":137},[58,87,108],{"slug":59,"name":60,"problem":61,"products":62},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":88,"name":89,"problem":90,"products":91},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[92,100],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":109,"name":110,"problem":111,"products":112},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[113,121,129],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"grey-market-ai-relay-service-hijacks-enterprise-codex-and-claude-code-deployments","Grey Market AI Relay Service Hijacks Enterprise Codex and Claude Code Deployments","A grey market relay service has been intercepting enterprise AI tools by installing unauthorized versions of OpenAI Codex and Claude Code, then reconfiguring them to route all prompts, files, and authentication tokens through attacker-controlled servers. The attackers deliberately disable sandboxing and telemetry, stripping away the very security controls designed to contain AI tool behavior and alert defenders. This matters because affected organizations lose visibility into what data is leaving their environment while simultaneously exposing credentials and proprietary files to a third party. The targeting of industrial-sector companies in mainland China suggests deliberate economic espionage motives, amplifying the potential business and regulatory impact.",[143,144,145,146,147,148,149],"CIS Control 2: Inventory and Control of Software Assets","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1199: Trusted Relationship","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":151,"NIS2 Article 21(2)(b)":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"MITRE ATT&CK T1199: Trusted Relationship":154,"CIS Control 2: Inventory and Control of Software Assets":155,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":156,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":157},"Routing enterprise files and authentication tokens through attacker-controlled servers likely constitutes a personal data breach, requiring appropriate technical safeguards to ensure processing security.","The disabling of telemetry and sandboxing eliminated incident detection capability; NIS2 requires entities to implement controls for handling incidents and maintain security monitoring.","Attackers exploited the ability to replace and reconfigure legitimate tools; a formal process for verifying software integrity and patching configurations would have detected tampering.","The attackers exploited the implicit trust organizations place in their AI developer tools to silently redirect sensitive data, a classic trusted-relationship abuse vector.","Unauthorized relay-modified versions of Codex and Claude Code were installed in enterprise environments; maintaining an authorized software inventory would have flagged these non-approved installations immediately.","The unauthorized reconfiguration of AI tools to disable security features represents a misconfiguration vulnerability that a technical vulnerability management program should identify and remediate.","The relay service harvested login tokens routed through attacker-controlled servers; strong identity controls and token scoping would have limited the value of intercepted credentials."]