Shadow AI Relay Services Strip Sandboxes from OpenAI Codex and Claude Code: Detection and Hardening Guide

---
title: Agentic AI CLI Executed With Sandbox or Approval Bypass
description: Detects Codex CLI or Claude Code launched with flags that disable sandboxing and approval gates, as distributed by unofficial AI relay services.
id: 3f8a1c62-7b4d-4e91-a2c5-9d0e1f2a3b4c
status: experimental
references:
  - https://www.darkreading.com/threat-intelligence/ai-relay-service-openai-codex-claude-code-sandboxes
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\codex.exe'
      - '\claude.exe'
      - '\node.exe'
  selection_flags:
    CommandLine|contains:
      - '--dangerously-bypass-approvals-and-sandbox'
      - '--dangerously-skip-permissions'
      - 'danger-full-access'
      - '--sandbox-mode danger'
  condition: selection_image and selection_flags
falsepositives:
  - Legitimate power-user developer workflows (rare; should be exception-approved per user)
level: high
---
title: AI API Base URL Redirected to Non-Official Endpoint
description: Detects shell or process launch where OpenAI/Anthropic base URL environment variables are overridden, redirecting API traffic through third-party relay infrastructure.
id: 8c2d4e71-1a3b-4f56-b7d8-2e9f0a1b5c6d
status: experimental
references:
  - https://www.darkreading.com/threat-intelligence/ai-relay-service-openai-codex-claude-code-sandboxes
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1552
  - attack.exfiltration
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'OPENAI_BASE_URL='
      - 'OPENAI_API_BASE='
      - 'ANTHROPIC_BASE_URL='
  filter_official:
    CommandLine|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
  condition: selection and not filter_official
falsepositives:
  - Corporate LLM gateways and approved internal proxies (maintain an allowlist of sanctioned gateway domains)
level: high
---
title: AI CLI Configuration Modified for Custom Endpoint or Disabled Sandbox
description: Detects writes to Codex/Claude configuration files introducing custom base URLs or disabling approval and sandbox enforcement.
id: b5e7f109-4c2d-48a3-9e61-7f3a0b8c2d4e
status: experimental
references:
  - https://www.darkreading.com/threat-intelligence/ai-relay-service-openai-codex-claude-code-sandboxes
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\.codex\config'
      - '\.claude\settings'
      - '\.claude.json'
  condition: selection_path
falsepositives:
  - Normal user preference edits; tune by alerting on content where telemetry supports it or pairing with network detections
level: medium

// Hunt 1: Agentic AI CLIs launched with sandbox/approval bypass on Windows endpoints
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any (
    "--dangerously-bypass-approvals-and-sandbox",
    "--dangerously-skip-permissions",
    "danger-full-access")
   or (ProcessCommandLine has "--sandbox-mode" and ProcessCommandLine has "danger")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName, SHA256
| order by TimeGenerated desc;

// Hunt 2: Network egress from AI CLI processes to non-official API destinations
// Baseline first: build an allowlist of your sanctioned LLM gateways, then alert on everything else.
let OfficialEndpoints = dynamic(["api.openai.com", "api.anthropic.com", "chatgpt.com", "claude.ai"]);
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("codex.exe", "claude.exe", "node.exe", "codex", "claude")
   or InitiatingProcessCommandLine has_any ("codex", "claude-code")
| where RemoteUrl !in~ (OfficialEndpoints)
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by Connections desc;

-- Artifact: SecurityArsenal.AI.RelayHunt
-- Hunts developer endpoints for AI coding CLIs running in unsandboxed mode
-- or holding environment overrides pointing API traffic at unofficial relays.

LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(codex|claude)'
  AND (
       CommandLine =~ '(?i)dangerously-(bypass|skip)'
    OR CommandLine =~ '(?i)danger-full-access'
    OR CommandLine =~ '(?i)(OPENAI_BASE_URL|OPENAI_API_BASE|ANTHROPIC_BASE_URL)=https?://'
  )

LET conns = SELECT Pid, Name, Status, Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Name =~ '(?i)(codex|claude|node)'
  AND Rport = 443

SELECT * FROM procs
UNION ALL
SELECT Pid, NULL AS Ppid, Name, NULL AS Exe,
       format(format='connection %v:%v -> %v:%v [%v]', args=[Laddr, Lport, Raddr, Rport, Status]) AS CommandLine,
       NULL AS Username, NULL AS CreateTime
FROM conns

# SecurityArsenal-AI-RelayAudit.ps1
# Audits Windows developer endpoints for relay-style AI CLI misconfigurations.
# Run via your RMM/Intune/SCCM as SYSTEM or collect output centrally.

$findings = @()

# 1) Check machine- and user-level environment variables for API endpoint overrides
$relayVars = 'OPENAI_BASE_URL','OPENAI_API_BASE','ANTHROPIC_BASE_URL','ANTHROPIC_API_URL'
foreach ($scope in 'Machine','User') {
    foreach ($v in $relayVars) {
        $val = [Environment]::GetEnvironmentVariable($v, $scope)
        if ($val -and $val -notmatch 'api\.openai\.com|api\.anthropic\.com') {
            $findings += [pscustomobject]@{ Check='EnvOverride'; Scope=$scope; Variable=$v; Value=$val }
        }
    }
}

# 2) Inspect Codex CLI config for disabled sandbox or custom providers
$users = Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue
foreach ($u in $users) {
    $codexCfg = Join-Path $u.FullName '.codex\config.toml'
    if (Test-Path $codexCfg) {
        $cfg = Get-Content $codexCfg -Raw -ErrorAction SilentlyContinue
        if ($cfg -match 'sandbox_mode\s*=\s*"danger-full-access"') {
            $findings += [pscustomobject]@{ Check='CodexSandboxDisabled'; Scope=$u.Name; Variable='sandbox_mode'; Value='danger-full-access' }
        }
        if ($cfg -match 'base_url\s*=\s*"https?://(?!api\.openai\.com)') {
            $findings += [pscustomobject]@{ Check='CodexCustomBaseURL'; Scope=$u.Name; Variable='base_url'; Value=($Matches[0]) }
        }
    }
    $claudeCfg = Join-Path $u.FullName '.claude.json'
    if (Test-Path $claudeCfg) {
        $cfg2 = Get-Content $claudeCfg -Raw -ErrorAction SilentlyContinue
        if ($cfg2 -match '"skipDangerouslySkipPermissions"\s*:\s*true|"bypassPermissionsModeAccepted"\s*:\s*true') {
            $findings += [pscustomobject]@{ Check='ClaudePermissionBypass'; Scope=$u.Name; Variable='claude.json'; Value='permission bypass accepted' }
        }
    }
}

# 3) Report — ship JSON to your SIEM or write to a central share
if ($findings) {
    $findings | ConvertTo-Json | Out-File "$env:ProgramData\AI-RelayAudit-$(hostname)-$(Get-Date -Format yyyyMMdd).json"
    Write-Warning "Relay-style AI CLI misconfigurations detected. Review findings file."
} else {
    Write-Output "No AI relay indicators found on $(hostname)."
}

#!/usr/bin/env bash
# ai-relay-audit.sh — Linux/macOS equivalent. Run via MDM/chef/ansible across dev fleets.
echo "=== AI Relay Audit: $(hostname) ==="

# 1) Env overrides in shell profiles
for f in /home/*/.bashrc /home/*/.zshrc /home/*/.profile /root/.bashrc /etc/profile.d/*.sh; do
  grep -HEn 'OPENAI_BASE_URL|OPENAI_API_BASE|ANTHROPIC_BASE_URL' "$f" 2>/dev/null \
    | grep -vE 'api\.openai\.com|api\.anthropic\.com'
done

# 2) Codex config with sandbox disabled or custom provider
for cfg in /home/*/.codex/config.toml /root/.codex/config.toml; do
  [ -f "$cfg" ] || continue
  grep -Hn 'danger-full-access' "$cfg"
  grep -HnE 'base_url\s*=\s*"https?://' "$cfg" | grep -v 'api\.openai\.com'
done

# 3) Running processes with bypass flags
ps -eo user,pid,args | grep -E 'codex|claude' | grep -E 'dangerously|danger-full-access' | grep -v grep

echo "=== Audit complete ==="