Symantec found a reseller service that sets up real AI coding tools, then switches off their safety limits and routes everything through its own servers.
Researchers at Symantec say an unauthorized reseller of AI coding tools has been installing the real OpenAI Codex and Anthropic Claude Code programs on work computers, then quietly turning off their safety limits. The service has been active since at least early 2026. It has touched a dozen organizations, most of them in mainland China.
Codex and Claude Code are AI helpers that read files, write code and run commands on the computer where they are installed. They have a sandbox, which is a fenced-off area meant to limit what the AI can do. The reseller's setup script removes that fence. For Codex, it sets the mode to "danger-full-access" and allows network access.
It also swaps the user's own access keys for keys issued by the reseller. Every request then goes to the reseller's servers instead of OpenAI's or Anthropic's. Reporting of usage data and errors is switched off too, which hides the change from the vendors.
The tools themselves are not modified. A user installs them normally, then runs a one-line command that appears to come from the reseller. That command downloads a setup script from a lookalike web address. Because the script does a real, working install first, it looks routine. Symantec saw no automatic or exploit-based delivery, so people appear to run the command themselves.
On at least one computer, the script also logged the user out of their real Anthropic account and deleted their saved login settings before putting the reseller's keys in place.
Most cases look like employees or companies that wanted a Western AI coding tool not officially sold in their market and turned to a reseller. Affected sectors include:
The list also includes operations of firms based in South Korea, Taiwan and Malaysia. The reseller has used at least eight different web domains that imitate OpenAI or Anthropic chat services.
Symantec found no evidence that the operator has abused its position. The risk is that this setup would let the reseller read every prompt, file and secret the AI handles, and run commands with the user's full permissions. This is not a flaw in Codex or Claude Code. They are working as designed after their settings were changed.
Businesses can check whether staff use AI coding tools bought through third-party resellers. On a computer where one is installed, the settings files are worth a look. Codex uses ~/.codex/config.toml and Claude Code uses ~/.claude/settings.json. Unfamiliar web addresses or a sandbox set to full access are warning signs.
Cheap third-party access to AI coding tools can mean handing a stranger your files and passwords, so get these tools only from the vendors.
A new Alibaba-led test of real coding requests found the best AI agent fully finished just 26.4 percent of tasks, so human review still matters.
Read more: AI coding helpers fully finish only about 1 in 4 real tasksEA has re-released 25 classic PC games at a discount until November 19, and Bethesda has finally given The Elder Scrolls VI a subtitle: Sentinel.
Read more: EA brings 25 classic PC games back, and Elder Scrolls VI gets a nameA user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websites
