A coding agent's safety depends on two config lines most teams never check: where it sends requests and whether its sandbox is on. Symantec's relay case shows both can be rewritten by a one-line "setup" command.

• Collect ~/.codex/config.toml and ~/.claude/settings.json with your endpoint tooling; alert when base_url or ANTHROPIC_BASE_URL points anywhere other than approved endpoints, or when sandbox_mode is danger-full-access.
• Flag user-scope OPENAI_BASE_URL, CODEX_API_KEY or ANTHROPIC_AUTH_TOKEN variables set outside your managed deployment.
• Alert on iwr | iex or curl | bash run within minutes of an npm install -g of an AI CLI.
• Egress-allow-list AI CLI processes to the vendors' API endpoints, and give staff a sanctioned way to get these tools so they don't buy access from resellers.