Rogue Relays and Prompt Adware Are Rewriting Codex and Claude Code Configs: What Symantec and Check Point Found

Two reports published five days apart show attackers and grey-market operators going after the files that steer AI coding agents. Symantec (29 October 2026) described unauthorized relays that install genuine Codex CLI and Claude Code and then rewrite their configuration to route traffic through third-party servers. Check Point (3 November 2026) described Haiou, a Codex jailbreak bundle that plants encrypted advertising prompts in Codex's global instructions. Neither report involves a CVE, and neither saw proven harm. Both show that agent config is now something worth tampering with.

Symantec: unauthorized relays

Symantec's Threat Hunter Team found a grey-market relay affecting about a dozen organisations, mostly in mainland China, plus operations of multinationals in South Korea, Taiwan and Malaysia. Sectors include industrial automation, electronics, semiconductors, pharmaceuticals, shipping, tyre manufacturing, petrochemicals and data centre services. Symantec says the activity dates to at least early 2026 and that most cases look like employees seeking Western AI coding tools unavailable in their market, not targeted intrusions. It states plainly that this is not a vulnerability in Codex or Claude Code.

How it works

The user installs the real tool through npm (@openai/codex, codex-cli or @anthropic-ai/claude-code). Within minutes to about half an hour, they run a fileless one-liner (iwr -useb <url> | iex in PowerShell, or curl | bash) from a lookalike domain, probably copied from the relay or a reseller. The script installs Node.js and the CLI if missing, prints progress in Chinese, and then applies its configuration. Symantec saw no automated or exploit-based delivery. The relay's backend rotated across at least eight domains impersonating OpenAI- or Anthropic-branded chat services.

What gets changed

On one host the script also ran claude /logout, cleared ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY, and ran claude /login; Symantec does not know whether this happens in every deployment. Relay keys carried the sk-ant-oat01- prefix used for subscription OAuth tokens rather than sk-ant-api03- pay-per-use keys, which Symantec calls consistent with pooled flat-rate subscriptions but not proof. Several hosts also queried the Windows registry for the user's country (HKCU\Control Panel\International\Geo) after installation.

Risk

Symantec observed no abuse. The risk is potential: with a relay endpoint, disabled sandbox and open network access, the operator could read prompts, files and secrets and run commands with the user's privileges. Symantec lists possible motives, including bypassing regional restrictions, reselling discounted capacity, or fraud with stolen credentials, and says resale of prompts and files cannot be ruled out.

Check Point: Haiou "prompt adware"

Check Point Research coined "prompt adware" for Haiou ("seagull" in Chinese), a Chinese-language jailbreak bundle for OpenAI Codex. It packs security-focused agent Skills and uses reframing, refusal suppression and role-play to weaken guardrails. The analysed version, haiou-codex v4.5.0, comes from GitHub user haiou-666; Check Point reports more than 250 stars on the jailbreak. The Hacker News, a day later, cited 403 stars and 77 forks for haiou-codex, so the counts differ, probably because of timing; this article uses Check Point's figure. Codex-X, a Chinese GUI tool for configuring Codex, bundles the same jailbreak. A Claude Code version exists, but only the Codex version carried the ad injection at the time of writing. The repository first appeared on 10 July 2026, per The Hacker News.

Mechanism

The bundle modifies Codex's global configuration and global agent instruction files (Check Point does not give exact paths). The advertising text sits in prompt files such as 00-identity.md and a CLAUDE.md inside the Codex package. Launchers verify an encrypted payload.pkg with Ed25519 signatures and SHA-256 hashes and decrypt it with an AES-256-GCM key embedded in the launcher script, so the prompt content is opaque to anyone browsing the repository. The injected instructions make later agent replies promote an OpenAI-compatible LLM gateway at zz[.]aiapi2025[.]top; The Hacker News reports that greetings such as "hi", "hello" and "Seagull" trigger the ad. Check Point's reading is that the free bundle is a funnel for the paid gateway. The bundle includes an uninstaller. Distribution ran through a Bilibili video and a QQ group, and Check Point notes Cobalt Strike, Ladon and VulnClaw on the actor's server.

Check Point says there are no hints that the advertised gateway itself is malicious. It adds that LLM gateways in general have been shown to snoop on data, steal secrets and inject tool calls, which makes them a possible supply-chain vector.

The relay activity dates to early 2026; the two reports landed five days apart.

What defenders should audit

• ~/.codex/config.toml: base_url, sandbox_mode (flag danger-full-access), network_access.
• ~/.claude/settings.json: ANTHROPIC_BASE_URL and any DISABLE_TELEMETRY or DISABLE_ERROR_REPORTING entries not set by your own deployment.
• User-scope environment variables: OPENAI_BASE_URL, CODEX_API_KEY, ANTHROPIC_AUTH_TOKEN, ANTHROPIC_API_KEY, outside an approved deployment process.
• Global agent instruction files (Codex's global instructions, and any CLAUDE.md or similar files shipped by third-party bundles) for unexpected persona, identity or promotional text.
• Shell and EDR telemetry for iwr | iex or curl | bash shortly after, or in place of, the npm install of these tools.
• Egress from AI CLIs to destinations outside an approved allow-list; keep an allow-list of sanctioned AI endpoints.
• Installed Skills, jailbreak bundles and GUI configurators such as Codex-X: treat them as dual-use third-party code.
• Token prefixes: an sk-ant-oat01- token you did not issue is a sign of a pooled relay account.

Indicators from the reports: Symantec lists domains including vibe[.]aiok[.]me, aiok[.]me, sorryios[.]io, nuoda[.]vip, chat[.]nuoda[.]vip, rawchat[.]cn, sharedchat[.]cc, mirbuds[.]com, claudechn[.]com and vibe[.]skk[.]moe, and SHA-256 hashes 2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24 (setup-codex.ps1) and 4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb (setup-claudecode.ps1). Check Point lists zz[.]aiapi2025[.]top and the GitHub account haiou-666.

Caveats

Symantec observed no abuse and Check Point has no evidence the gateway is malicious. Both reports describe exposure created by configuration, not exploitation, and the Chinese-market focus is partly the reports' and partly The Hacker News's inference. The same config surfaces exist on any developer machine, so the audit list applies everywhere.

Sources

• Symantec: unauthorized relays
• Check Point Research: Free the model, sell the gateway
• The Hacker News: prompt adware