Grey Market AI Relay Service Hijacks Enterprise Codex and Claude Code Deployments
Written by AI from the linked story. Not reviewed by an editor. How this works
A grey market relay service has been intercepting enterprise AI tools by installing unauthorized versions of OpenAI Codex and Claude Code, then reconfiguring them to route all prompts, files, and authentication tokens through attacker-controlled servers. The attackers deliberately disable sandboxing and telemetry, stripping away the very security controls designed to contain AI tool behavior and alert defenders. This matters because affected organizations lose visibility into what data is leaving their environment while simultaneously exposing credentials and proprietary files to a third party. The targeting of industrial-sector companies in mainland China suggests deliberate economic espionage motives, amplifying the potential business and regulatory impact.
Tactical Insight
Immediate actions
- Audit all installed AI developer tools against an approved software inventory and remove any unauthorized or unverified versions immediately.
- Revoke and rotate any API keys, login tokens, or credentials that may have been processed through potentially compromised AI tool instances.
- Re-enable and verify that sandboxing and telemetry settings on all AI coding tools are active and match vendor-supplied default secure configurations.
Long-term improvements
- Establish a formally approved list of permitted AI tools and enforce installation only from official vendor channels via application allowlisting controls.
- Implement network egress filtering to block AI tool traffic routed to non-vendor endpoints, ensuring prompts and files cannot be silently redirected.
- Integrate AI tool supply chain vetting into the broader third-party and software procurement risk management process.
Detection measures
- Deploy Data Loss Prevention (DLP) controls that inspect outbound connections from developer workstations for unusual volumes of source code, files, or token data.
- Monitor endpoint telemetry for configuration changes to AI tools, specifically changes that disable sandboxing or redirect traffic endpoints, and alert on any deviation from baseline.