Overview
A previously unidentified relay service has been discovered routing access to OpenAI Codex and Anthropic Claude Code — two widely-used AI coding assistants — to users in mainland China and other regions where these products are not officially available. Critically, the service appears to disable key sandbox security features before delivering the tools to end users. This is not a passive access workaround; the removal of sandbox controls fundamentally changes the risk profile of the affected AI coding environments.
Sandboxing is a primary defence mechanism in agentic AI coding tools. It ensures that code generated or executed by the AI is contained within an isolated environment, preventing lateral movement, filesystem access, or network calls that fall outside defined parameters. When these controls are stripped, AI-generated code runs with significantly elevated trust and capability.
Technical Analysis
The relay service appears to function as a man-in-the-middle layer, intercepting API requests and responses between users and the official OpenAI and Anthropic infrastructure. By modifying the configuration presented to the AI coding environment, the service can suppress sandbox enforcement flags or agent execution boundaries that would otherwise be applied.
In tools like Claude Code and OpenAI Codex, sandbox policies govern what the AI agent can do when it autonomously writes and executes code — including filesystem read/write permissions, shell command access, and external network calls. Disabling these controls effectively grants the AI agent, and any code it generates or runs, unrestricted access to the host environment.
The mechanism aligns with known techniques for modifying AI agent configurations (AML.T0081) and gaining unauthorised inference API access (AML.T0040), combined with supply chain interception at the delivery layer (AML.T0010).
Framework Mapping
- AML.T0040 – AI Model Inference API Access: The relay provides unsanctioned access to model APIs in restricted geographies.
- AML.T0081 – Modify AI Agent Configuration: Sandbox security settings are altered before the tool reaches the end user.
- AML.T0010 – AI Supply Chain Compromise: The relay inserts itself into the legitimate software supply chain.
- LLM05 – Supply Chain Vulnerabilities: Delivery of a modified, security-degraded version of a legitimate AI tool.
- LLM08 – Excessive Agency: With sandboxes disabled, AI agents operate beyond their intended permission boundaries.
- LLM02 – Insecure Output Handling: Code outputs from the AI may be executed without the containment controls that official deployments enforce.
Impact Assessment
Users relying on this relay service are exposed to AI-generated code execution in an unsandboxed context, dramatically increasing the blast radius of any prompt injection, jailbreak, or malicious code generation scenario. Organisations whose developers unknowingly use such services face potential full host compromise from AI agent activity. Beyond individual users, this also undermines the trust model that AI coding tool vendors have built into their safety architecture.
The geographic targeting — mainland China and similarly restricted markets — suggests a deliberate strategy to exploit regulatory gaps where official vendor enforcement mechanisms do not reach.
Mitigation & Recommendations
- Verify that all AI coding tool traffic routes directly to official OpenAI (
api.openai.com) and Anthropic (api.anthropic.com) endpoints using DNS inspection and TLS certificate validation. - Block access to known unofficial AI relay or proxy infrastructure at the network perimeter.
- Enforce internal policies requiring developers to use only vendor-approved distribution channels for AI coding assistants.
- Treat any AI coding environment whose provenance cannot be confirmed as untrusted; run all generated code in independently controlled sandboxes regardless of tool claims.
- Monitor for anomalous agent behaviour — unexpected filesystem access or outbound connections — as indicators of sandbox removal.