{"event":{"id":"evt-20261101-relay","dedupe_key":"source_milestone:rts_finding_17d56562081a45d7a9156f6520e9915b","event_type":"publication_or_official_action","title":"Symantec discloses unauthorized coding-agent relay configurations disabling sandbox protections","summary":"On 29 October 2026 Symantec published technical research describing unauthorized third-party relay installations at roughly 12 organizations since early 2026. Genuine Codex and Claude Code clients were reconfigured to route prompts through third parties and disable or reduce sandbox and telemetry protections. These are observed configuration changes, not discovered vulnerabilities in the official CLIs, evidence of stolen secrets or confirmed subsequent malicious exploitation.","occurred_at":"2026-10-29T00:00:00.000Z","published_at":"2026-10-29T00:00:00.000Z","observed_at":"2026-11-01T08:10:00.305Z","reconstructed_at":null,"ingest_type":"live_evidence_only","locations":null,"status":"verified","confidence":0.93,"metadata":{"rts_finding_id":"rts_finding_17d56562081a45d7a9156f6520e9915b","evidence_only":1,"epistemic_scope":"dated_primary_source_publication_or_official_action","no_relation_onset":1,"no_civilization_snapshot":1,"bounded_novelty_only":1},"created_at":"2026-11-01T08:17:01.291Z","updated_at":"2026-11-01T08:17:01.291Z"},"artifacts":[{"id":"art-20261101-relay","dedupe_key":"04ac054ac40eeaa7f3cfa5795722c8b75bf2eca4453896905f014d0bf45513a8","canonical_url":null,"evidence_locator":"","artifact_type":"publication","title":"Symantec discloses unauthorized coding-agent relay configurations disabling sandbox protections","summary":"On 29 October 2026 Symantec published technical research describing unauthorized third-party relay installations at roughly 12 organizations since early 2026. Genuine Codex and Claude Code clients were reconfigured to route prompts through third parties and disable or reduce sandbox and telemetry protections. These are observed configuration changes, not discovered vulnerabilities in the official CLIs, evidence of stolen secrets or confirmed subsequent malicious exploitation.","creator_entities":[],"released_at":"2026-10-29T00:00:00.000Z","content_hash":null,"metadata":{"rts_finding_id":"rts_finding_17d56562081a45d7a9156f6520e9915b","evidence_only":1,"epistemic_scope":"dated_primary_source_publication_or_official_action","no_relation_onset":1,"no_civilization_snapshot":1,"bounded_novelty_only":1},"created_at":"2026-11-01T08:17:01.287Z","updated_at":"2026-11-01T08:17:01.287Z","relation":"documents"}],"signals":[]}