AI Relay Misconfigurations Turn Sandboxes Into Full-Access Environments

Summary

An unauthorized grey-market relay service reconfigures legitimate OpenAI Codex and Anthropic Claude Code CLIs to route prompts and credentials through third-party infrastructure. The service disables built-in sandboxing and telemetry, effectively giving the relay operator access to user prompts, files, and secrets. This configuration creates opportunities for data theft or command execution under the user’s privileges.

Investigation

Threat hunters identified the relay service operating since early 2026 and primarily affecting organizations in mainland China, along with multinational subsidiaries in South Korea, Taiwan, and Malaysia. The investigation uncovered a fileless delivery mechanism using PowerShell or bash scripts downloaded from lookalike domains. Because the service repurposes legitimate tools instead of distributing trojanized versions, detection can be more difficult.

Mitigation

Organizations should monitor for changes to base_url or ANTHROPIC_BASE_URL in CLI configuration files and for sandbox_mode being set to danger-full-access. Implement allow-lists for approved AI service endpoints and monitor unauthorized user-level environment variables such as OPENAI_BASE_URL or ANTHROPIC_AUTH_TOKEN. Defenders should also investigate one-line iwr or curl commands executed shortly after legitimate npm installations.

Response

When this activity is detected, isolate the affected host to reduce the risk of command execution through the disabled sandbox. Revoke and rotate all API keys, tokens, and environment variables associated with the affected AI tools. Conduct a forensic review of prompts, files, and data transmitted through the relay to determine the extent of potential exposure.

Simulation Execution

• Attack Narrative & Commands: The adversary has compromised a webserver and seeks to bypass corporate AI usage policies. Instead of using the official API, they download a lightweight CLI tool and modify its configuration to point to vibe.aiok.me. This allows them to intercept all prompts and responses sent by the user, effectively creating a “Man-in-the-Middle” relay for AI interactions. The simulation uses curl to simulate the connection attempt to the unauthorized domain, which should generate the network telemetry required to trigger the rule.

• Regression Test Script:

  #!/bin/bash
  # Simulation of unauthorized AI relay connection
  echo "[*] Starting AI Relay Domain Simulation..."
  
  # Target domain from the detection rule
  TARGET_DOMAIN="vibe.aiok.me"
  
  echo "[*] Attempting connection to $TARGET_DOMAIN to trigger detection..."
  # We use curl to initiate a connection which generates network telemetry
  curl -v "http://$TARGET_DOMAIN/api/v1/relay" --connect-timeout 5
  
  echo "[*] Simulation command executed."

• Cleanup Commands:

  # No persistent changes made by the simulation script.
  echo "[*] Cleaning up simulation artifacts... Done."