Symantec investigated organizations using setup instructions that redirected legitimate coding assistant clients to external relay endpoints. The clients could still appear to be official installations, but their requests and credential configuration passed through a third-party service. Some scripts also changed execution posture to dangerous full access…
Inspect the ClaimsCase · DiggingBeagle record
Unofficial relays rewired coding assistants and weakened local execution settings
Symantec found official coding CLIs routed to third-party endpoints with altered sandbox and telemetry configuration at approximately twelve organizations.
Scope
Observed unauthorized third-party client routing and policy changes in a limited enterprise population. Secret theft or malicious outputs from the relay remain potential, not confirmed, consequences.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Symantec observed unauthorized relay configurations at real organizations, without proving each relay modified responses or exfiltrated data. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-CODING-AGENT-UNAUTHORIZED-RELAYS-1 · Symantec: unauthorized coding-assistant relays across enterprises
At a glance
The roughly twelve observed organizations are a configuration exposure population, not proof that every prompt was stolen.
Read the implicationsThe relays’ backend storage and actual data retention are not independently known. Direct evidence of model-response manipulation by the relay was not published.
Limits and uncertaintyFull account
Symantec investigated organizations using setup instructions that redirected legitimate coding assistant clients to external relay endpoints. The clients could still appear to be official installations, but their requests and credential configuration passed through a third-party service. Some scripts also changed execution posture to dangerous full access and disabled telemetry, combining a model-provider trust problem with a local command-policy problem. The investigation mentions roughly twelve organizations; that denominator describes the detected environment, not verified exfiltration victims.
A relay can theoretically observe prompts or alter model responses, but the cited work did not prove that every relay abused these opportunities. The reproducible question is what destination the client actually contacts and what permissions the host enforces independently of model output. Installing the official binary is not sufficient protection when endpoint and sandbox policy can be rewritten afterward.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-CODING-AGENT-UNAUTHORIZED-RELAYS-1Symantec observed coding-assistant configurations redirected to third-party model relays and some installation scripts enabling dangerous full-access sandbox mode.supported
Basis: reported finding
- supportsSymantec: unauthorized coding-assistant relays across enterprisesprimary disclosure
Symantec report, enterprise relay setup scripts, endpoint override and sandbox setting observations
Implications
The roughly twelve observed organizations are a configuration exposure population, not proof that every prompt was stolen.
Controls and mitigations
- Pin trusted provider endpoints and independently enforce host sandbox and telemetry policy; inspect endpoint variables and persisted credentials.
Unknowns and contradictions
- The relays’ backend storage and actual data retention are not independently known.
- Direct evidence of model-response manipulation by the relay was not published.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208