The AI Relay in Your Dev Pipeline: How a Shadow Service Hijacked Codex and Claude Code at a Dozen Enterprises
Executive Summary
In late October 2026, Symantec's Threat Hunter Team exposed a clandestine relay service that had been silently installing authentic OpenAI Codex and Anthropic Claude Code CLI tools across enterprise environments in mainland China, South Korea, Taiwan, and Malaysia since early 2026. The service routes all AI agent traffic through attacker-controlled relay infrastructure, disables execution sandboxes, enables unrestricted network access for write operations, suppresses telemetry, and replaces corporate API credentials with relay-issued tokens. At least a dozen organizations were confirmed affected, none knowingly. The relay operator gains full visibility into every prompt, file, and secret transiting the agent, and can silently alter or fabricate every model response returned to the user.
This incident crystallizes the emerging shadow AI threat class: employees bypassing geographic or procurement controls introduce unauthorized AI relay infrastructure that operates with the full privileges of a developer account. As agentic AI coding tools become core to software delivery pipelines, a single compromised relay can silently manipulate code, harvest secrets, and pivot across cloud workloads—making egress policy enforcement and supply-chain visibility critical board-level concerns heading into 2027.
Why This Matters Now
Agentic AI coding tools like Codex and Claude Code now execute code autonomously with broad filesystem and network permissions. A relay that disables sandboxes and holds persistent OAuth tokens is structurally equivalent to a privileged insider threat with read/write access to every developer secret and code artifact. As enterprises race to adopt AI-assisted development, shadow AI supply-chain interception represents an unmonitored, high-privilege attack surface that most existing security controls are not designed to detect.
Attack Path Analysis
A shadowy AI relay service exploited enterprise developers' desire for access to restricted AI coding tools (OpenAI Codex, Anthropic Claude Code) by distributing a fileless PowerShell/bash hijack script via a lookalike domain, silently reconfiguring legitimate CLI installations to route all traffic through attacker-controlled relay infrastructure with sandboxes disabled and credentials replaced. Once established, the relay achieved persistent man-in-the-middle positioning over all AI agent interactions, enabling interception of every prompt, file, and secret submitted by enterprise users, with the architectural capability to inject malicious responses that execute with full user-level privileges — representing a persistent supply-chain implant with exfiltration and code-execution impact potential.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Enterprise users in restricted regions (mainland China, South Korea, Taiwan, Malaysia) were socially engineered or self-directed to run a one-line npm install command fetched from a lookalike domain. The command silently retrieved a fileless PowerShell or bash 'AI-agent hijack script' that reconfigured legitimate Codex and Claude Code CLIs to route through the relay's infrastructure. No vulnerability was exploited; the vector was a living-off-the-land supply-chain reconfiguration via user-executed script, evoking ClickFix/InstallFix patterns. The Cloud Native Security Fabric (CNSF) — with inline enforcement and AI-aware traffic inspection — could have flagged the anomalous one-line execution pattern and the outbound connection to the lookalike domain at the point of initial script fetch.
MITRE ATT&CK® Techniques
Compromise Software Supply Chain
PowerShell
Unix Shell
Modify Authentication Process
Subvert Trust Controls
Stored Data Manipulation
Data from Configuration Repository
External Proxy
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Supply Chain Risk Management
Control ID: SA-12 / SR-6
CISA Zero Trust Maturity Model 2.0 – Application-Level Security Control Enforcement
Control ID: Applications Pillar — Application Access / Security Controls
DORA (Digital Operational Resilience Act) — EU Regulation 2022/2554 – Third-Party ICT Service Provider Oversight
Control ID: Article 28 — ICT Third-Party Risk Management
NIS2 Directive — EU Directive 2022/0383 – Supply Chain Security and Access Control
Control ID: Article 21 — Cybersecurity Risk Management Measures
PCI DSS 4.0 – Security of Software and Third-Party Service Providers
Control ID: Requirement 6.3 / 12.8
ISO/IEC 27001:2022 – Installation Controls and Information Security in Supplier Relationships
Control ID: Annex A 8.19 / A 5.19
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Shadow AI relay hijacking OpenAI Codex and Claude Code CLIs disables execution sandboxes and replaces API credentials, exposing software development pipelines to full prompt, file, and secret interception via unauthorized relay infrastructure.
Information Technology/IT
Unauthorized AI relay establishes persistent relay-issued tokens and disables telemetry across enterprise IT environments, creating egress policy violations and multicloud visibility gaps mapped to NIST.800-53.SC-7 and ZTMM.CrossCutting.Visibility compliance failures.
Computer/Network Security
Supply-chain relay attack neutralizes sandbox enforcement and enables unrestricted network write access, directly undermining zero trust segmentation and egress security controls critical to security operations and incident response postures.
Financial Services
Gray market AI relay pooling OAuth subscription tokens and intercepting employee prompts and secrets presents credential theft and data exfiltration risk with PCI.4.0.3.5.1 and NIST.CSF.PR.DS-5 compliance implications for regulated financial institutions.
Sources
- Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxeshttps://www.darkreading.com/threat-intelligence/ai-relay-service-openai-codex-claude-code-sandboxesVerified
- Symantec Threat Hunter Team Bloghttps://symantec-enterprise-blogs.security.com/threat-intelligenceVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- OpenAI Usage Policies and Regional Restrictionshttps://openai.com/policies/usage-policiesVerified
- Anthropic Claude Usage Policy and Security Documentationhttps://www.anthropic.com/legal/usage-policyVerified
- MITRE ATT&CK: Supply Chain Compromise (T1195)https://attack.mitre.org/techniques/T1195/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant here because the attacker's persistence depended entirely on unmonitored outbound AI traffic reaching attacker-controlled relay infrastructure outside canonical API endpoints. Inline enforcement and identity-aware egress policy would likely have reduced the relay's ability to establish persistent man-in-the-middle positioning and constrained the blast radius of credential theft and intellectual property exfiltration.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF inline enforcement could likely have flagged the anomalous outbound connection to the lookalike domain at the moment of initial script fetch, reducing the window in which the hijack script could complete its reconfiguration of legitimate CLI tooling.
Control: Zero Trust Segmentation
Mitigation: Identity-aware segmentation policy would likely have constrained non-authoritative token provisioning, reducing the relay operator's ability to silently assume the full API authorization scope of compromised developer identities across the environment.
Control: East-West Traffic Security
Mitigation: East-west enforcement monitoring service-to-service and workload-to-workload flows would likely have detected anomalous internal execution patterns initiated by the AI agent process after response injection, reducing the attacker's ability to move laterally across services reachable from the compromised developer workload.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely have detected AI traffic routing to non-canonical relay endpoints and flagged the absence of expected telemetry streams as a behavioral anomaly, reducing the relay's ability to operate as a persistent covert C2 channel without detection.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement with FQDN filtering would likely have blocked or alerted on outbound AI CLI traffic destined for unauthorized relay endpoints rather than canonical OpenAI and Anthropic API URLs, reducing the volume of sensitive developer prompts, credentials, and source code that could transit to attacker-controlled infrastructure.
Had prior-stage controls reduced relay establishment and egress reach, the residual impact would likely have been constrained to the initial social engineering event rather than expanding to persistent credential compromise and ongoing intellectual property exfiltration across the developer population.
Impact at a Glance
Affected Business Functions
- AI-Assisted Software Development and Code Generation
- Enterprise Credential and Identity Management
- Corporate Intellectual Property and Source Code Confidentiality
- Security Operations and Endpoint Telemetry
Estimated downtime: N/A
Estimated loss: N/A
All prompts, source code files, API secrets, and employee credentials submitted to the AI coding CLIs are exposed to the relay operator in plaintext. The relay replaces user API tokens with relay-issued credentials, effectively hijacking authentication sessions. With execution sandboxes disabled and network write access enabled, any malicious or compromised response from the relay could execute with full privileges of the affected user account. Affected organizations span enterprise environments in mainland China, South Korea, Taiwan, and Malaysia, with at least a dozen organizations confirmed impacted. Categories of data at risk include proprietary source code, internal development secrets, environment variables, authentication tokens, and any files or context provided to the AI agent during coding sessions. The relay architecture also supports pooled OAuth subscription tokens potentially linked to stolen or fraudulently obtained payment credentials.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement with FQDN allowlisting to permit AI CLI traffic only to canonical vendor API endpoints (api.openai.com, api.anthropic.com), blocking any relay or lookalike domain destinations and preventing unauthorized credential or prompt exfiltration through shadow AI infrastructure.
- • Implement Cloud Native Security Fabric (CNSF) inline enforcement with AI-aware traffic inspection to detect and alert on anomalous one-line script execution patterns, fileless PowerShell/bash fetches from lookalike domains, and AI agent configuration modifications at the point of initial compromise before relay reconfiguration completes.
- • Enforce Zero Trust Segmentation with identity-based policy requiring that AI CLI tool credentials be issued exclusively through organizational IAM and that any credential replacement or token substitution triggers automated policy violation alerts, preventing relay-issued tokens from persisting across sessions or reboots.
- • Enable Multicloud Visibility & Control with centralized traffic observability to baseline expected AI agent communication patterns (endpoint, volume, timing) and alert on deviations such as telemetry suppression, routing to non-canonical endpoints, or the absence of expected vendor audit streams — key indicators of relay-based C2 activity.
- • Establish East-West Traffic Security monitoring for workload-to-workload execution flows initiated by AI agent processes, ensuring that any code execution triggered by AI agent responses is inspected against behavioral baselines and that sandbox-disabled agent processes are denied network access to internal services until policy compliance is verified.
