The report
Symantec examined development environments where legitimate coding assistant CLIs had been reconfigured to use third-party relay services instead of their expected model endpoints. Some related setup scripts also set local sandbox policy to dangerous full access or disabled telemetry. Approximately twelve organizations were present in the investigation, but the report does not show that all their prompts were stolen or that every altered endpoint issued malicious commands.
The two changes are different security problems. A relay may receive source context, credentials or prompts, while the local sandbox setting controls what actions an answer can execute on the machine. A hostile relay could exploit their combination, but exposure to an unauthorized relay is not the same as verified data exfiltration. The research account supports the altered configurations and the canonical investigation records the unproven outcomes.
The inspection point is the effective client configuration: resolved API base URL, certificate and token destination, agent tool policy, telemetry state and any setup script that changed them. A familiar executable name or vendor logo does not attest to its backend or grant it permission to weaken host restrictions.