Relay service strips sandboxes from Codex and Claude Code

An unidentified relay service is distributing OpenAI's Codex and Anthropic's Claude Code to users in mainland China and other regions where the two companies do not officially sell their products, and has turned off key security features in the process, according to a report published by Dark Reading on 29 October 2026.

The outlet describes the operator only as "enigmatic". It does not name the service, its owners or its customers. The report says the tools are being supplied with security sandboxes disabled.

A sandbox is a restricted environment that limits what a program can read, write or run on the machine it sits on. For coding agents, which generate and often execute code on a developer's computer, that boundary is one of the main controls standing between a model's output and the rest of the system. Removing it means the agent's actions are no longer penned in.

Both products are agentic coding tools: software that takes instructions in plain language and then writes, edits and runs code with limited human review of each step. That design is what makes the sandbox question material. If an agent can be steered by untrusted input, such as text pulled from a repository or a web page, the sandbox is what is supposed to contain the damage.

The mechanics of the relay are not detailed in the available reporting. It is not clear how the service obtains access to the two vendors' systems, how many users it serves, how long it has been running, or whether OpenAI or Anthropic have moved to block it. Neither company is quoted in the material reviewed for this article, and there is no indication at this stage of a breach of either vendor's own infrastructure.

On the facts reported, this is a configuration problem rather than a flaw in either product. The protections exist; a third party in the middle appears to have switched them off before passing the tools on. Users of such a relay have no practical way to verify what settings they are getting, because the service sits between them and the vendor.

The case is a reminder that the security posture of an AI agent depends on who delivers it, not only on who built it. Grey-market resale channels exist precisely because official access is unavailable, and users of those channels inherit whatever decisions the intermediary has made. Where an agent is permitted to execute code, those decisions reach directly into the developer's machine.

The Agentic Times has not independently verified the report. We will update this story if OpenAI or Anthropic comment.