Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
User runs agentrelay and selects Cloudflare, FRPC, or SSH connectivity.
Impact
An authenticated remote relay user can submit prompts to a Codex process with danger-full-access permissions.
Mechanism
authenticated web relay to a Codex app-server launched in yolo mode
Rationale
No malicious install hook, exfiltration, payload loading, or hidden persistence was found. The intentionally exposed unrestricted agent-control capability is a real dual-use risk.
Evidence
package.jsondist/src/server/index.jsdist/src/server/backends/codex/appServerManager.jsdist/src/server/startup/tunnelManager.jsdist/src/server/api/webApiServer.jsdist/src/server/config/config.js~/.agentrelay/config.toml~/.codex/config.toml~/.codex/sessions