---
title: Tip: inventory where your AI coding CLIs actually send traffic; alert on base_url changes and sandbox_mode = "danger-full-access" | ctxsec
url: https://ctxsec.com/items/tip-audit-ai-cli-config-base-url-and-sandbox-mode
description: ""
status: "guidance (based on Symantec's Oct 2026 relay research)"
published: 2026-10-30
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-audit-ai-cli-config-base-url-and-sandbox-mode.md)

guidance (based on Symantec's Oct 2026 relay research)

2026-10-30

### Tip: inventory where your AI coding CLIs actually send traffic; alert on base_url changes and sandbox_mode = "danger-full-access"

A coding agent's safety depends on two config lines most teams never check: where it sends requests and whether its sandbox is on. Symantec's relay case shows both can be rewritten by a one-line "setup" command.

- Collect `~/.codex/config.toml` and `~/.claude/settings.json` with your endpoint tooling; alert when `base_url` or `ANTHROPIC_BASE_URL` points anywhere other than approved endpoints, or when `sandbox_mode` is `danger-full-access`.
- Flag user-scope `OPENAI_BASE_URL`, `CODEX_API_KEY` or `ANTHROPIC_AUTH_TOKEN` variables set outside your managed deployment.
- Alert on `iwr | iex` or `curl | bash` run within minutes of an `npm install -g` of an AI CLI.
- Egress-allow-list AI CLI processes to the vendors' API endpoints, and give staff a sanctioned way to get these tools so they don't buy access from resellers.

Sources: [Symantec Threat Hunter Team: Sandbox flipped to "danger-full-access": unauthorized AI relays create risk for organizations](https://www.security.com/threat-intelligence/openai-claude-unauthorized-relays)