Executive Summary
Since early 2026, a grey market relay service has been observed targeting organizations primarily in mainland China and multinational subsidiaries in South Korea, Taiwan, and Malaysia. The service facilitates the use of AI coding agents like OpenAI Codex and Anthropic Claude Code in restricted regions by repurposing genuine CLI tools. While no active abuse has been confirmed, the service's configuration changes introduce extreme risk by disabling security sandboxes and routing all enterprise data through unverified third-party servers.
The attack chain involves users executing a fileless PowerShell or bash script following a legitimate installation via npm. This script silently reconfigures the AI clients to use a relay-controlled backend, replaces legitimate API credentials with relay-issued tokens, and disables telemetry. This architecture grants the relay operator the ability to read every prompt, file, and secret passed through the agent, while the disabled sandbox allows for potential arbitrary command execution with user privileges.
Affected sectors include industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, and petrochemicals. The primary driver appears to be employee demand for Western AI tools in markets where they are not officially available, highlighting a critical 'Shadow AI' risk where productivity needs override established security boundaries.