// OpenaiHIGH
Symantec Threat Hunter Team discovered unauthorized relay services targeting OpenAI Codex and Anthropic Claude Code CLIs at 12 organizations since early 2026, predominantly in mainland China. The relay intercepts legitimate installations and modifies configuration files to disable sandboxing, enable full network access, and redirect API requests to attacker-controlled servers. This allows operators to intercept all prompts, files, and credentials, with potential to execute arbitrary code with user privileges.
// Get alerts for Openai