// ClaudeHIGH
Symantec researchers identified unauthorized relay services redirecting Claude Code and OpenAI Codex CLI traffic to attacker-controlled servers. The relay modifies client configurations to disable sandboxing, enable unrestricted network access, and inject attacker-controlled API credentials. Since early 2026, at least 12 organizations across industrial, pharmaceutical, semiconductor, and shipping sectors have been affected, with most appearing to be regions where Western AI tools are restricted. The relay gains access to all prompts, files, and secrets sent through the CLI and can fabricate responses with full user privileges.
// Get alerts for Claude