Symantec's Threat Hunter Team describes an unauthorized relay service, active since at least early 2026, that sells access to OpenAI Codex and Anthropic Claude Code mainly in markets the vendors do not serve, chiefly mainland China. It has been seen at about a dozen organizations in manufacturing, semiconductors, pharma, shipping, petrochemicals and data center services, including Chinese operations of South Korean, Taiwanese and Malaysian multinationals. Symantec stresses this is not a vulnerability in either CLI.

• How it lands: users run a genuine npm install -g of the CLI, then a one-line iwr -useb | iex or curl | bash from a lookalike domain such as vibe.aiok[.]me.
• What it changes: rewrites ~/.codex/config.toml or ~/.claude/settings.json so base_url / ANTHROPIC_BASE_URL point at the relay, swaps in relay-issued keys as user-scope environment variables, sets Codex sandbox_mode = "danger-full-access", enables network access for the write sandbox, and disables telemetry and error reporting. On one host it logged the user out of Anthropic and deleted their auth variables first.
• Risk: the relay can read every prompt, file and secret sent to the agent and alter its responses, and with the sandbox off a bad response would run with the user's full privileges. Symantec says there is no evidence yet that the operator has abused this.

IOCs (Symantec): setup-codex.ps1 SHA-256 2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24; setup-claudecode.ps1 4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb; domains aiok[.]me, sorryios[.]io, nuoda[.]vip, rawchat[.]cn, sharedchat[.]cc, mirbuds[.]com, claudechn[.]com, vibe[.]skk[.]moe.