GoKawiilUnauthorized relay service installs modified OpenAI Codex, Claude Code tools, disabling safety settings
Symantec's Threat Hunter Team identified a relay service that has been installing genuine OpenAI Codex and Anthropic Claude Code command-line tools on enterprise systems since early 2026, primarily in mainland China, South Korea, Taiwan, and Malaysia. The service reroutes AI requests through its own infrastructure instead of OpenAI's or Anthropic's servers and disables built-in security safeguards, though researchers have not found evidence of malware or active exploitation yet.