Zero Radar
← feed
HighSecurity incidentupdated 29 Oct 2026, 10:02 UTC

Unofficial AI relay turns off security sandboxes in coding tools

A third-party service gives people in regions where OpenAI and Anthropic don't officially sell their products access to popular AI coding tools. The service reportedly switches off key safety protections, so code run through these tools may

1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?UnclearNo reports either way yet
What to doCheck exposureStop routing AI coding tools through unofficial relay services that turn off sandbox protections.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Developer requestUses unsupported-region AI coding tool
  2. 2Relay serviceForwards traffic to AI tools
  3. 3Sandbox disabledKey security features turned off
  4. 4Code runs uncheckedExecuted without sandbox restrictions
  5. ResultCode runs without sandbox protection

What happened

A shadowy relay service provides OpenAI Codex and Claude Code access to mainland China and other unsupported regions and disables their sandbox security features.

Why it is dangerous: Disabling sandboxes means AI-generated or AI-executed code may run with fewer restrictions on the user's machine or data, raising risk of malware, data exposure, or unintended system changes for anyone using the relay.

Are you affected?

You are affected if you use a third-party relay or proxy service to access OpenAI Codex or Claude Code in a region where they are not officially sold.

OpenAI Codex and Claude Code accessed through the unofficial relay service (versions not stated).

What to do

  1. Stop using unofficial relay services for AI coding tools until their security posture is verified.
  2. Use official access channels for OpenAI and Anthropic products where available.
  3. If you already used the relay, review code it generated or executed and check for unexpected changes or data transfers.
  4. Keep sandbox and security features enabled in any AI coding tool you run.

Timeline

  1. 29 Oct 2026, 10:00 UTC
    Publicly disclosed
  2. 29 Oct 2026, 10:00 UTC
    Reported by Dark Reading · Dark Reading
  3. 29 Oct 2026, 10:02 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-196b1e60
Disclosed
29 Oct 2026, 10:00 UTC
On Zero Radar
29 Oct 2026, 10:02 UTC (3 min after disclosure)
Last change
29 Oct 2026, 10:02 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Unofficial AI relay turns off security sandboxes in coding tools · Zero Radar