Symantec warns AI coding relay disables key security safeguards

A relay service reportedly used to access OpenAI Codex and Anthropic Claude Code has been reconfiguring the tools to disable important safeguards, according to Dark Reading’s account of Symantec research. Symantec says it found no malicious activity, but the setup could expose organisations to serious risks because the relay can see prompts, files and secrets sent through it.

Watch Desk analysis

What happened

Dark Reading reports that Symantec traced the service to installations at a dozen organisations, mainly in mainland China, as well as South Korea, Taiwan and Malaysia. The service routes requests through its own infrastructure rather than the AI companies’ networks, while installing genuine versions of the command-line tools, the report says.

The reported configuration changes turn off the tools’ execution sandbox, enable network access for the write sandbox, disable telemetry and error reporting, and replace users’ credentials with relay-issued tokens. Symantec analyst Brigid O Gorman told Dark Reading that researchers had not observed malicious activity. The service’s operators and purpose remain unclear.

Why it matters

A coding agent with its sandbox disabled may be able to act with more of the user’s privileges than intended. And when prompts, files and credentials pass through a third-party relay, that operator may be able to see sensitive material or alter responses. Those are risks described by Symantec, not evidence that the service has already exploited them.

The account also has a practical lesson for organisations: genuine software can still be unsafe when someone else changes its configuration and controls the route its requests take. A familiar command-line tool is not a security guarantee if the safeguards have quietly been switched off.

Our read

This is a serious warning about shadow AI access, not proof that the relay operators are conducting an attack. Symantec’s reported finding that no malicious activity was observed matters, but so does the combination of disabled safeguards and relay-controlled credentials. Organisations should check how AI coding tools are installed and configured, and whether requests are going to an approved service. Convenience is a poor trade if the price is handing a stranger the keys and the chat history.

What to watch

• Whether Symantec publishes further technical details or indicators organisations can use to check for the reported configuration.
• Whether affected organisations or the relay’s operators provide an explanation.
• Whether OpenAI or Anthropic issue guidance for checking Codex or Claude Code installations.

Discussion spark: Should organisations block unofficial AI coding relays outright, or allow them when employees can verify that safeguards and credentials remain under their control?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.