Brief · Builders

Your coding agent's settings file is the new proxy setting.

By alkizz · Oct 30, 2026

Symantec's Threat Hunter Team published a write-up on Oct 29 about a grey-market relay service that sells access to OpenAI's Codex and Anthropic's Claude Code, mostly in mainland China, where neither vendor officially sells them. The relay doesn't ship a fake client. Users install the real CLI from npm, then run a one-line setup script that rewrites the tool's settings so every request goes through the relay's servers instead of OpenAI's or Anthropic's. In Codex's case it also flips the sandbox to danger-full-access. Symantec says it has seen this at a dozen organizations since early 2026.

Symantec is careful about what this is and isn't, so I will be too. In its words: "This is not a vulnerability in Codex or Claude Code. The tools are behaving as designed once their configuration has been changed." And: "There is no evidence the operator is currently abusing its position."

So why write it up? Because the trick isn't regional. Your coding agent's base URL is the new proxy setting. Whoever controls it sees every prompt, file and secret you send the agent, and gets to write the answers that come back. If that same settings file also has the sandbox switched off, those answers can run as you.

What's actually confirmed

A dozen organizations, mostly in mainland China. Symantec also lists the Chinese operations, and in some cases the home-market operations, of multinationals based in South Korea, Taiwan and Malaysia. Sectors include industrial automation, electronics, semiconductors, pharma, shipping and petrochemicals. Symantec reads most of these as employees who wanted a Western coding assistant they couldn't buy locally, not as chosen targets.
People ran it themselves. Users installed @openai/codex, codex-cli or @anthropic-ai/claude-code with npm install -g, and within minutes to roughly half an hour a fileless PowerShell or bash script arrived via iwr -useb <url> | iex or curl | bash from a lookalike domain such as vibe[.]aiok[.]me. Symantec "did not observe any automated or exploit-based delivery." The one-line command embeds a relay-issued key and the relay's endpoint, and the script prints progress messages in Chinese, which suggests users are copying a ready-made command from the relay or its reseller.
What it changes. The script rewrites ~/.codex/config.toml or ~/.claude/settings.json, swaps the base_url (or ANTHROPIC_BASE_URL) for a relay domain, drops in a relay-issued key, and sets both as user-scope environment variables so they survive a reboot. It also sets the sandbox to full access, turns on network access for the write sandbox, and switches off telemetry and error reporting. Symantec's snippet: sandbox_mode = "danger-full-access", network_access = "true", DISABLE_TELEMETRY=1, DISABLE_ERROR_REPORTING=1.
On one host, it logged the user out first. The script ran claude /logout, deleted ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY, then ran claude /login. Symantec couldn't tell whether that happens in every deployment.
The business model is a guess, and Symantec says so. The Claude Code keys the relay handed out started with sk-ant-oat01- (Anthropic's subscription OAuth prefix) rather than sk-ant-api03- (pay-per-use API keys), which Symantec calls "consistent with, though not proof of" pooled flat-rate subscriptions being resold. Stolen cards and reselling the prompts are, in its words, "plausible and cannot be ruled out."
No abuse seen, only potential. Symantec spells it out: "the configuration changes described above were observed; the risks that follow from them are potential."

Why the settings file is important

Both tools let you point them at a different API endpoint, on purpose, because companies run LLM gateways. Codex has openai_base_url and custom model_providers.<id>.base_url entries. Claude Code's ANTHROPIC_BASE_URL is documented as a way to "route requests through a proxy or gateway," and its settings reference shows it set in the env block of settings.json. That's a legitimate feature, and it's exactly the one the relay uses.

The good news is that Codex already won't take those keys from a repo. Per its config reference, a project-local .codex/config.toml can't set openai_base_url, chatgpt_base_url, model_provider or model_providers, so they have to live in your user-level config. That's why this relay needs you to run its script, and it's also why a quick look at one file on each machine tells you a lot.

The sandbox part is what turns "someone reads my prompts" into "someone can run commands as me." Codex's sandboxing docs define full access as sandbox_mode = "danger-full-access" together with approval_policy = "never". Symantec puts it bluntly: with the sandbox off and network on, "a malicious or compromised response could execute with the full privileges of the user's account." The relay's keys also sit in user-scope environment variables, so per Symantec any other tool on that machine that reads them can pick them up.

We've been here before with a planted AGENTS.md in Downloads, which tried to talk the agent into rewriting these same settings files. This time nobody had to trick the agent. A person pasted the command.

The score

I'd call it a 2, mostly calm. It isn't a bug, Symantec has seen no evidence the operator is abusing its position, and it only reaches you if someone on your team chose to route their agent through an unofficial reseller. Still, the check takes five minutes, and if anyone on your team has gone shopping for cheaper Codex or Claude Code access, treat yourself as a 3 and look this week.

What to do:

Read your Codex config for endpoint and sandbox changes you didn't make.
- Why: The relay's whole setup lives in ~/.codex/config.toml (on Windows, ~ is your %USERPROFILE% folder; if CODEX_HOME is set, Codex keeps its config there instead). An endpoint you didn't set means someone else sees your traffic, and danger-full-access means nothing is stopping a bad answer from running.
- How: grep -nE 'base_url|model_provider|sandbox_mode|default_permissions|approval_policy|network_access|analytics|feedback' ~/.codex/config.toml. On Windows PowerShell: Select-String -Path "$env:USERPROFILE\.codex\config.toml" -Pattern 'base_url','model_provider','sandbox_mode','default_permissions','approval_policy','network_access'. Red flags are an openai_base_url or provider base_url you can't explain, sandbox_mode = "danger-full-access" or default_permissions = ":danger-full-access" (config reference), and approval_policy = "never".
Read your Claude Code settings for a swapped endpoint or token.
- Why: Claude Code reads ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN from the env block in settings.json as happily as from your shell, and the docs note those env values are plain text and reach subprocesses.
- How: Check ~/.claude/settings.json, plus .claude/settings.json and .claude/settings.local.json in your projects: grep -nE 'ANTHROPIC_BASE_URL|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_API_KEY|apiKeyHelper|HTTPS?_PROXY|bypassPermissions|DISABLE_TELEMETRY|DISABLE_ERROR_REPORTING' ~/.claude/settings.json. Anything you didn't put there, ask why it's there.
List AI-related user environment variables by name, not value.
- Why: Symantec's watch list includes OPENAI_BASE_URL, CODEX_API_KEY and ANTHROPIC_AUTH_TOKEN set as user-scope environment variables outside an approved deployment. On Windows those live in HKEY_CURRENT_USER\Environment (Microsoft), survive reboots, and are visible to every tool you run. Keeping keys out of your dotfiles and injecting them at runtime is builders item 1.
- How: In PowerShell, (Get-Item HKCU:\Environment).Property | Select-String 'OPENAI|CODEX|ANTHROPIC' prints names only, so you don't splash keys on screen. Then check the endpoints specifically: [Environment]::GetEnvironmentVariable('ANTHROPIC_BASE_URL','User') and the same for OPENAI_BASE_URL. On macOS or Linux: env | grep -E '^(OPENAI_BASE_URL|ANTHROPIC_BASE_URL)='. Symantec doesn't say where the bash version of the script saves its variables, so also check the usual shell startup files: grep -nE 'OPENAI_BASE_URL|ANTHROPIC_BASE_URL|CODEX_API_KEY|ANTHROPIC_AUTH_TOKEN' ~/.bashrc ~/.zshrc ~/.profile 2>/dev/null.
Treat "paste this one-liner after you install" as the attack.
- Why: The relay's script did a real install of the real tool, so it looked routine to the user and, per Symantec, to most monitoring tools.
- How: Install Codex and Claude Code from the vendors' own instructions and stop there. If you have EDR, Symantec suggests watching for a PowerShell iwr | iex or bash curl | bash run shortly after, or in place of, an npm install -g of these CLIs.
Lock the sandbox centrally if you manage machines.
- Why: A setting the developer (or a reseller's script) can change is a suggestion. That's builders item 16 and Business Checklist item 13.
- How: For Codex, a requirements.toml (/etc/codex/requirements.toml on macOS and Linux, %ProgramData%\OpenAI\Codex\requirements.toml on Windows) with allowed_sandbox_modes = ["read-only", "workspace-write"] blocks danger-full-access; OpenAI's managed configuration docs say to prefer allowed_permission_profiles on Codex 0.138.0 or later. Requirements can also enforce model_provider and model_providers (reference). For Claude Code, put "permissions": {"disableBypassPermissionsMode": "disable"} in managed-settings.json, which beats user and project settings. On Claude Code v2.1.285 or later, "allowedProviders": ["anthropic"] in managed settings refuses sessions routed to any other endpoint.
Allow-list where AI CLIs are allowed to talk.
- Why: A relay only works if the agent can reach it. Symantec's watch list includes AI CLI traffic to destinations outside an allow-list of approved AI service endpoints.
- How: If you have an egress proxy or firewall, allow the official API endpoints (and your own gateway, if you run one) and alert on the rest. That's builders item 9.
If you find relay settings on a machine:
- Preserve first: copy ~/.codex/config.toml, ~/.claude/settings.json, PowerShell and shell history, and an export of HKCU\Environment before you clean anything.
- Check Symantec's IOCs. Setup scripts by SHA-256: 2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24 (setup-codex.ps1) and 4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb (setup-claudecode.ps1). Domains include vibe[.]aiok[.]me, aiok[.]me, sorryios[.]io, nuoda[.]vip, chat[.]nuoda[.]vip, rawchat[.]cn, sharedchat[.]cc, mirbuds[.]com, claudechn[.]com and vibe[.]skk[.]moe; the full list is in the report.
- Assume everything the agent saw went to the relay. Rotate any keys, tokens or passwords that were in prompts, in files the agent read, or in environment variables on that machine, then put the official endpoint and login back (claude /login, or codex login, per each vendor's docs). If people on your team are signing in with AI accounts the company doesn't manage, that's Business Checklist item 17.

Sources

← All briefs

Your coding agent's settings file is the new proxy setting.

What's actually confirmed

Why the settings file is important

The score

Want the next one?

Sources

Related

On the checklist

More briefs