An Agent Hears Whoever Its Config Names

The two coding agents themselves had not been touched. In a report published October 29, Symantec’s Threat Hunter Team describes installations of OpenAI’s Codex and Anthropic’s Claude Code that came from the legitimate npm packages. The change came shortly afterward, in a handful of settings in the user’s home directory.

A setup script, fetched with a one-line command after the legitimate install, swapped each tool’s API address and credentials for ones issued by a relay service. In Codex’s ~/.codex/config.toml, it also set sandbox_mode to danger-full-access and turned on network access for the write sandbox. For Claude Code, it stored the relay’s address and key as user-level environment variables. In both, it switched off telemetry and error reporting, which Symantec says would also cut off usage signals that could otherwise have reached OpenAI or Anthropic. The report does not say why the script does this.

Symantec says it has seen the relay in use at a dozen organizations since early 2026. Most are in mainland China; others are multinational companies based in South Korea, Taiwan and Malaysia, in sectors including industrial automation, electronics manufacturing and semiconductors. The figure is a tally of organizations where the relay was observed, not of machines or victims. The report traces the demand to a simple gap: neither company officially sells these agents in mainland China, and individual employees looked for a way to use them anyway. Reselling capacity below market rates is named as another possible motive. Symantec’s reading is that users copied a ready-made command from the relay or a reseller and ran it themselves, though it says it has not seen where the command was posted.

The report separates what it saw from what it fears. It found no evidence so far that the relay operator has abused the access, and it puts the distinction in one sentence: “the configuration changes described above were observed; the risks that follow from them are potential.” The potential is considerable. A relay in that position receives every prompt, file and secret an employee sends to the agent, and can alter or invent the replies that come back. With Codex’s sandbox opened, a malicious or compromised reply could run with the full privileges of the user’s account. Symantec sells security products, and its report carries no comment from OpenAI or Anthropic. I found no public statement from either company on the report as of October 30.

My reading is this. Verifying that an agent’s binary is genuine tells you what its hands are. It does not tell you whose voice those hands are listening to: the plans the agent follows arrive as replies from the address in its settings. Whether a given plan is carried out still depends on the approval rules and the account’s permissions, and the relay loosened one of those as well. A pasted command can change the voice on the other end without changing a byte of the program.

Two older cases show how shortcuts around trusted software have looked before. On November 9, 2011, federal prosecutors in Manhattan announced charges against seven people over DNSChanger, malware they said altered the DNS server settings of more than four million computers in over 100 countries, rerouting users to sites and advertisements that earned the defendants at least $14 million. According to the prosecutors, the malware also blocked antivirus and operating-system updates that might have detected it. In September 2015, Palo Alto Networks described XcodeGhost, a tampered copy of Apple’s developer tool. Its researchers wrote that downloads from Apple’s servers were sometimes very slow, so some Chinese developers got Xcode from other sources; the modified copy built malicious code into apps that reached the App Store.

Placed beside this week’s report, the three cases differ in what had to be broken. DNSChanger’s operators had to infect machines to change one setting. XcodeGhost’s authors had to alter the tool itself, and slow official downloads helped it spread. In the relay Symantec describes, the tool is authentic, the official product is not on sale in that market, and by the report’s account the user makes the change. What passes through the redirected line is different too: in 2011, the answer to where a website lives; now, the next step for a program that may edit code and run commands.

Both companies document ways for an organization to set rules above the user. Anthropic’s settings documentation places managed settings at the top of the order and says, “Nothing in your own settings files or --settings overrides a managed key.” Its environment-variable reference says a settings-file value replaces the one inherited from the shell in most sessions, and that a managed entry overrides the same variable in user or project settings. OpenAI’s managed-configuration guide calls its requirements “admin-enforced constraints that users can’t override.” Its example for deployments still on the older sandbox setting allows only read-only and workspace-write, leaving out the full-access mode the relay switched on; newer versions use permission profiles instead.

Those rules work only where an organization has put them in place, and the report does not say whether any of the affected organizations had. Where an employee obtained a tool that is not sold locally, though, the company may not know the agent is there at all, and a policy cannot lock settings on software nobody is tracking. Symantec’s advice leans that way. It does not prescribe vendor policies; it lists traces for defenders to look for, including a changed base_url or ANTHROPIC_BASE_URL, danger-full-access in the Codex file, and AI command-line tools sending traffic to destinations outside an allow-list of approved AI services. In practice, the boundary around these agents is drawn by whoever watches where they connect.

For organizations that let staff use coding agents, checking the installer is the easy part. The harder part is knowing who can edit the few lines that name the agent’s other end, and noticing when the usage signal that would have reached its maker goes quiet.