[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUJP9Y-qMERJqtkzHMTkBN6HbGfDZ-PSd5x3vVzKRVr0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"d275d099-2ddd-407a-8978-0e6b8397af47","grey-market-ai-relay-service-hijacks-enterprise-codex-and-claude-code-deployments","3475da1c-4e35-4001-88d4-7614e51406e3","Grey Market AI Relay Service Hijacks Enterprise Codex and Claude Code Deployments","A grey market relay service has been intercepting enterprise AI tools by installing unauthorized versions of OpenAI Codex and Claude Code, then reconfiguring them to route all prompts, files, and authentication tokens through attacker-controlled servers. The attackers deliberately disable sandboxing and telemetry, stripping away the very security controls designed to contain AI tool behavior and alert defenders. This matters because affected organizations lose visibility into what data is leaving their environment while simultaneously exposing credentials and proprietary files to a third party. The targeting of industrial-sector companies in mainland China suggests deliberate economic espionage motives, amplifying the potential business and regulatory impact.","**Immediate actions:**\n- Audit all installed AI developer tools against an approved software inventory and remove any unauthorized or unverified versions immediately.\n- Revoke and rotate any API keys, login tokens, or credentials that may have been processed through potentially compromised AI tool instances.\n- Re-enable and verify that sandboxing and telemetry settings on all AI coding tools are active and match vendor-supplied default secure configurations.\n\n**Long-term improvements:**\n- Establish a formally approved list of permitted AI tools and enforce installation only from official vendor channels via application allowlisting controls.\n- Implement network egress filtering to block AI tool traffic routed to non-vendor endpoints, ensuring prompts and files cannot be silently redirected.\n- Integrate AI tool supply chain vetting into the broader third-party and software procurement risk management process.\n\n**Detection measures:**\n- Deploy Data Loss Prevention (DLP) controls that inspect outbound connections from developer workstations for unusual volumes of source code, files, or token data.\n- Monitor endpoint telemetry for configuration changes to AI tools, specifically changes that disable sandboxing or redirect traffic endpoints, and alert on any deviation from baseline.",[12,13,14,15,16,17,18],"CIS Control 2: Inventory and Control of Software Assets","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1199: Trusted Relationship","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"MITRE ATT&CK T1199: Trusted Relationship":23,"CIS Control 2: Inventory and Control of Software Assets":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Routing enterprise files and authentication tokens through attacker-controlled servers likely constitutes a personal data breach, requiring appropriate technical safeguards to ensure processing security.","The disabling of telemetry and sandboxing eliminated incident detection capability; NIS2 requires entities to implement controls for handling incidents and maintain security monitoring.","Attackers exploited the ability to replace and reconfigure legitimate tools; a formal process for verifying software integrity and patching configurations would have detected tampering.","The attackers exploited the implicit trust organizations place in their AI developer tools to silently redirect sensitive data, a classic trusted-relationship abuse vector.","Unauthorized relay-modified versions of Codex and Claude Code were installed in enterprise environments; maintaining an authorized software inventory would have flagged these non-approved installations immediately.","The unauthorized reconfiguration of AI tools to disable security features represents a misconfiguration vulnerability that a technical vulnerability management program should identify and remediate.","The relay service harvested login tokens routed through attacker-controlled servers; strong identity controls and token scoping would have limited the value of intercepted credentials.","published","2026-10-30T09:20:26.247993+00:00","2026-10-30T09:20:26.217+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Funauthorized-openai-codex\u002F","unauthorized-openai-codex-and-claude-code-relays-disable-ai-sandboxes-and-redire-392056","Unauthorized OpenAI Codex and Claude Code Relays Disable AI Sandboxes and Redirect Enterprise Data",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":48,"name":49,"slug":50,"description":51,"color":52},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[55,59,63],{"slug":56,"name":57,"problem":58},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":60,"name":61,"problem":62},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":64,"name":65,"problem":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]