OTX Threat: Sandbox Flipped to 'Danger-Full-Access': Unauthorized AI Relays Create Risk for Organizations

An unauthorized relay service has been installing genuine OpenAI Codex and Anthropic Claude Code command-line interfaces on enterprise systems, then reconfiguring them to route all requests through third-party infrastructure. Active since early 2026, the service has impacted organizations primarily in mainland China, with additional cases in South Korea, Taiwan, and Malaysia. Affected sectors incl Sectors: Manufacturing, Semiconductor, Healthcare