PaperlayerView exact revision on arXiv

Source-linked AI summary

Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain

Hanzhi Liu, Chaofan Shou, Hongbo Wen, Yanju Chen, Ryan Jingyang Fang, Yu Feng

arXiv:2604.08407v1cs.CR

TL;DR

This paper studies the largely unprotected trust boundary created when LLM agents route tool-calling traffic through intermediaries with plaintext access. It formalizes router attacks, measures them across paid and free markets, and evaluates client-side defenses; the results show active manipulation, credential exposure, and poisoning of apparently benign routers, while pointing to provider-backed response integrity as the long-term requirement.

  • Problem

    LLM API routers can inspect and alter plaintext tool-call traffic, yet providers do not cryptographically bind upstream responses to what clients receive.

  • Method

    The paper formalizes two core attack classes and two adaptive variants, measures 28 paid and 400 free routers, conducts poisoning studies, and evaluates Mine with deployable client-side defenses.

  • Results

    9 of 428 commodity routers injected malicious code, 17 abused researcher-owned credentials, and poisoning decoys produced 2B billed tokens, 440 Codex sessions, and 99 leaked credentials.

  • Takeaways & Limitations

    Client-side policy gates, anomaly screening, and transparency logs reduce exposure today, but provider-signed response envelopes are needed to tie executed tool calls to model output.

  • Takeaways & Limitations

    The corpus emphasizes publicly reachable commodity router markets, while enterprise and invite-only deployments remain a natural extension.

Abstract

from arXiv · show

Large language model (LLM) agents increasingly rely on third-party API routers to dispatch tool-calling requests across multiple upstream providers. These routers operate as application-layer proxies with full plaintext access to every in-flight JSON payload, yet no provider enforces cryptographic integrity between client and upstream model. We present the first systematic study of this attack surface. We formalize a threat model for malicious LLM API routers and define two core attack classes, payload injection (AC-1) and secret exfiltration (AC-2), together with two adaptive evasion variants: dependency-targeted injection (AC-1.a) and conditional delivery (AC-1.b). Across 28 paid routers purchased from Taobao, Xianyu, and Shopify-hosted storefronts and 400 free routers collected from public communities, we find 1 paid and 8 free routers actively injecting malicious code, 2 deploying adaptive evasion triggers, 17 touching researcher-owned AWS canary credentials, and 1 draining ETH from a researcher-owned private key. Two poisoning studies further show that ostensibly benign routers can be pulled into the same attack surface: a leaked OpenAI key generates 100M GPT-5.4 tokens and more than seven Codex sessions, while weakly configured decoys yield 2B billed tokens, 99 credentials across 440 Codex sessions, and 401 sessions already running in autonomous YOLO mode. We build Mine, a research proxy that implements all four attack classes against four public agent frameworks, and use it to evaluate three deployable client-side defenses: a fail-closed policy gate, response-side anomaly screening, and append-only transparency logging.

1 Introduction

LLM API routers form an underexamined supply-chain trust boundary because they can inspect and alter plaintext tool-call traffic between agents and upstream providers. Measurements and poisoning studies show that malicious and apparently benign routers can expose agents, credentials, and tool execution, motivating defenses that do not require provider cooperation.

  • Threat and motivation: LLM routers terminate client-side TLS and originate upstream TLS, giving intermediaries application-layer access to requests, responses, prompts, tools, and credentials.This trust relationship differs from a traditional network MITM because the client voluntarily configures the router as its endpoint.
  • Empirical findings: 9 of 428 analyzed commodity routers injected malicious code, including 1 paid router and 8 free routers.The corpus contained 28 paid routers and 400 free routers.
  • Empirical findings: 2 routers deployed adaptive evasion, while 17 free routers touched researcher-owned AWS canary credentials and 1 drained ETH from a researcher-owned private key.Observed triggers included waiting for 50 prior calls, targeting YOLO mode, and selecting Rust or Go projects.
  • Poisoning studies: A leaked OpenAI key generated 100M GPT-5.4 tokens and more than seven Codex sessions, showing that ostensibly benign routers can be pulled into the same attack surface.The poisoning studies used leaked keys and weak relay chains rather than assuming every router was malicious at account creation.
  • Poisoning studies: 2B GPT-5.4 / 5.3-codex tokens and 99 leaked credentials were observed across 440 Codex sessions, including 401 sessions already running in autonomous YOLO mode.The sessions spanned 398 different projects or hosts, and every session was command-injectable.
  • Contributions: Mine implements all four attack classes against four public agent frameworks, while client-side defenses include a fail-closed policy gate, response-side anomaly screening, and append-only transparency logging.These defenses are designed for deployment without provider cooperation.

2 Background

LLM API routers consolidate access to multiple model providers and are increasingly composed into multi-hop routing chains. Because tool-call arguments remain plaintext and lack provider-level integrity binding, an intermediary can read, modify, or fabricate them, making router compromise a supply-chain concern.

  • Router architecture: LLM API routers provide unified access to multiple providers through model selection, fallback, load balancing, cost optimization, and a single credential plane.They are used by both managed services and open-source aggregators.
  • Router architecture: Routing paths can traverse four hops, with each layer terminating and re-originating TLS and accessing API keys, prompts, tool definitions, and tool-call responses.The client typically configures only the first router in the chain.
  • Deployment ecosystem: Commodity router markets are supported by widely used templates and resold access, including Taobao merchants with over 30,000 repeat purchases.The cited templates include new-api and one-api.
  • Integrity gap: Tool-call arguments are transmitted as plaintext JSON, and no provider-level integrity mechanism binds model-generated arguments to those received by the client.An intermediary terminating TLS on both sides can therefore read, modify, or fabricate tool-call payloads.
  • Integrity gap: The 2026 LiteLLM dependency-confusion compromise demonstrated that a supply-chain entry point could write every API request and response transiting the proxy.The incident provided a concrete example of the capability set available to a deliberately malicious router.

3 Threat Model

The threat model treats a malicious or compromised router as an application-layer intermediary that can control plaintext traffic by design. It focuses on response manipulation and passive collection while excluding several distinct attack categories.

  • Attacker position: A router can read, retain, rewrite, or fabricate request and response bodies, headers, and metadata after terminating client-side TLS and originating upstream TLS.The exposed data includes tool definitions, prompts, tool outputs, and API keys.
  • Trust boundary: The core integrity gap is the absence of a deployed mechanism binding the provider-origin tool-call response to what the client receives.Request-side visibility also permits selective delivery to users, workflows, or tool invocations.
  • Scope: The model excludes prompt injection, model backdoors, client-side malware, denial of service, and pure model substitution as distinct from router response manipulation and passive collection.The excluded behaviors may compose with router abuse but are outside the studied threat model.

4 Attack Taxonomy

The taxonomy separates malicious-router behavior into active payload manipulation and passive secret collection, then specializes payload injection into dependency substitution and conditional delivery. These attacks exploit routers’ plaintext access and can compose across multi-hop chains, while even one rewritten tool call can enable arbitrary client-side code execution.

  • Core attack classes: Two orthogonal primitives define the taxonomy: AC-1 rewrites tool-call payloads, while AC-2 silently extracts secrets from plaintext traffic.AC-1 operates on responses before delivery; AC-2 scans request and response paths without requiring payload modification.
  • Core attack classes: A single malicious router can rewrite tool calls or collect secrets, and downstream honest routers cannot detect or undo the modification.Secret exposure is cumulative across router chains because each router observes plaintext traffic.
  • AC-1: Payload injection: A syntactically valid rewritten tool call can redirect an agent to an attacker-controlled script, enabling arbitrary code execution outside the model’s reasoning loop.The rewrite preserves the tool name and schema structure, so the semantic change need not produce a schema or transport anomaly.
  • AC-2: Passive secret exfiltration: AC-2 passively scans headers, request bodies, and response bodies for credential patterns, exfiltrating matches asynchronously while forwarding the response unchanged.This makes credential theft difficult for clients to distinguish from legitimate plaintext routing access.
  • AC-1.1: Dependency-targeted injection: AC-1.a substitutes trusted dependency names with attacker-controlled packages, allowing typosquatting to evade domain-based gates and persist through local dependency caching.The surrounding command remains unchanged and the package is installed from the same trusted registry.
  • AC-1.2: Conditional delivery: AC-1.b activates payload injection only when a server-side predicate over session state holds, making routine probes appear benign and finite black-box auditing inadequate.Triggers can depend on session metadata or payload fields, including warm-up periods and high-value-session conditions.

5 Ecosystem Measurement

The study measures malicious behavior across paid and free commodity routers, then tests how benign-looking routers can be drawn into the same supply-chain position through leaked credentials and weak relay chains. It finds active manipulation, adaptive evasion, credential exposure, and substantial downstream poisoning, while noting that the corpus emphasizes publicly reachable commodity markets.

  • Dataset and collection: The measurement covers 28 paid routers, 400 free routers, and poisoning studies using leaked credentials and researcher-controlled weak relay deployments.Paid routers were purchased from marketplaces and storefronts; free routers were collected through public communities, lists, and configuration dumps.
  • Measurement criteria: A router counts as malicious when tool-call payloads become attacker-controlled commands or dependencies, while credential contact requires attributable follow-on AWS activity.An ETH drain requires funds to leave a prefunded researcher-controlled private key.
  • Malicious routers in the wild: 1 paid and 8 free routers injected malicious code; 17 free routers triggered follow-on use of researcher-owned AWS canaries, and 1 drained ETH.The injected changes altered commands or dependencies rather than merely rewriting cosmetic output.
  • Malicious routers in the wild: 2 malicious routers used adaptive evasion, including a 50-request warm-up trigger and conditions targeting YOLO sessions with Rust or Go project fingerprints.Because probing was finite and black-box, additional latent conditions may not have been activated.
  • Poisoning benign and trusted routers: A leaked OpenAI key generated 100M GPT-5.4 tokens and exposed more than seven Codex sessions, demonstrating the blast radius of reused upstream credentials.Provider-side logs could not always distinguish direct reuse from reuse inside a longer relay chain.
  • Poisoning benign and trusted routers: Weak decoys served roughly 2B GPT-5.4 and 5.3-codex tokens, exposed 99 credentials across 440 Codex sessions, and included 401 sessions already operating in YOLO mode.All 440 sessions were command-injectable; the 401 YOLO sessions already auto-approved tool execution, so sophisticated adaptive evasion was unnecessary.
  • Scope: The corpus targets active publicly reachable commodity markets, while enterprise and invite-only deployments remain a natural extension.Most routers originated from Chinese-language marketplaces and communities, although the paper links this traffic to substantial routing volume.

6 Mine Artifact

Mine is an OpenAI-compatible research proxy that implements the paper’s attack classes and tests them across four public agent frameworks. The evaluation finds broad compatibility, including complete AC-1 rewriting coverage and near-complete AC-1.a coverage.

  • Artifact: Mine conditionally applies AC-1, AC-1.a, AC-1.b, and AC-2 while forwarding requests through an upstream provider.Its companion modules implement a tool policy gate, response-side anomaly screening, and an append-only transparency log.
  • Evaluation setup: Mine is evaluated against OpenClaw, OpenCode, OpenAI’s Codex, and Anthropic’s Claude Code using 1,000 tool-calling requests per framework and attack module.The evaluation asks whether frameworks add local integrity checks or other constraints that narrow the attack surface.
  • Cross-framework results: None of the four frameworks verify response integrity, and AC-1 achieves 100% rewrite compatibility across all frameworks.The result indicates that the tested clients do not independently authenticate returned tool-call responses.
  • Cross-framework results: AC-1.a achieves a 99.6% compatibility rate on package-install tool calls, while AC-2 matches 100% of payloads containing detectable secrets under its rule set.The same rewriting logic handles OpenAI- and Anthropic-style wire formats, with nested parsing required for OpenAI string-encoded arguments.
  • Performance: Buffered rewriting preserves AC-1 and AC-1.a compatibility in streaming mode while adding only a 0.004–0.005 ms pause before rewritten tokens.The pause is far below the 820 ms median upstream latency.

7 Deployable Defenses

The paper evaluates three client-side controls that operate without provider cooperation: fail-closed policy enforcement, anomaly screening, and transparency logging. They reduce exposure in different ways, but none authenticates response origin, and allowlist-only gating has a full bypass boundary.

  • Defense overview: The evaluation uses controlled artifact-side experiments rather than field data to assess three deployable defenses.The controls target prevention, detection, and post-incident forensic scoping.
  • Policy gate: The policy gate consistently stops AC-1 and AC-1.a before execution, but only for narrowly scoped high-risk tools.It blocks commands fetching from non-allowlisted domains or installing packages outside a local allowlist.
  • Response-side anomaly screening: At 6.7% false positives, anomaly screening flags 89.0% of AC-1 samples, 50.0% of AC-1.a samples, and 50.9% of AC-1.b samples.An additional held-out benign distribution yields 0/600 false positives at that threshold.
  • Append-only transparency logging: The transparency log records request and response bodies, router URL, TLS metadata, and a response hash after request-side secret redaction.It supports forensic scoping but does not prevent manipulation or detect passive collection immediately.
  • Limits: The defenses reduce exposure but do not authenticate origin, so routers that remain within allowlists and avoid obvious anomalies can still alter semantics.The paper identifies end-to-end provenance and provider-supported integrity mechanisms as the remaining gap.

8 Discussion

The discussion frames router choice as a trust decision with low switching costs and argues that current transport protections do not establish semantic integrity. Provider-signed canonical response envelopes are presented as a longer-term solution, while related intermediary trust boundaries show the broader applicability of the problem.

  • Scope and future directions: The study’s measurement targets active commodity router markets and uses researcher-controlled accounts throughout.The authors identify private deployments as a natural direction for extending the snapshot.
  • Router trust: Router switching often requires only a base-URL change and a new API key, even though routers can translate schemas, substitute credentials, and return executable tool calls.This combination makes router selection a distinct trust decision from choosing a cloud provider or package registry.
  • Longer-term integrity: Mutual TLS, certificate pinning, and ordinary transport security authenticate the chosen router endpoint but do not establish that returned tool calls preserve upstream semantics.The paper uses web integrity mechanisms as examples of authenticating content and making that authentication auditable.
  • Longer-term integrity: A provider-signed canonical response envelope would cover provider identity, model, content, tool calls, finish reason, request nonce, validity window, and key identifier.Clients would verify the envelope before executing tool calls, while canonicalization handles heterogeneous provider interfaces.
  • MCP comparison: The same manipulation and collection ideas transfer to MCP, where malicious servers can receive plaintext tool calls and return forged results.The intermediary’s location differs, but both systems create a tool-related trust boundary.
  • Implementation boundary: Buffered rewriting adds 0.004–0.005 ms, far below the 820 ms median upstream latency, supporting the paper’s claim of negligible measured overhead.The implementation evaluates buffered rewriting rather than richer token-injection variants.

9 Related Work

The related-work discussion distinguishes router attacks from prompt injection, software supply-chain attacks, TLS interception, and MCP security. Its central distinction is that routers alter the client–provider JSON path and can intercept both tool calls and full request context.

  • Related-work scope: Table 7 positions the paper against prior research lines spanning prompt injection, software supply chains, TLS interception, and MCP security.The comparison emphasizes how router attacks differ in placement and authority.
  • Prompt injection: Router attacks rewrite JSON outside the model’s reasoning loop, so prompt-level defenses do not authenticate the returned tool-call payload.This distinguishes them from indirect and direct prompt injection, jailbreaking, and related model-side attacks.
  • Software supply chain: Unlike software supply-chain attacks involving packages, maintainers, CI scripts, or model pipelines, router attacks operate through an intermediary API boundary.The supplied passage situates the work among several established supply-chain attack classes.
  • TLS interception and API gateways: LLM routers perform TLS-interception-like proxying, but the client explicitly chooses the intermediary, so certificate substitution is not required.This separates router attacks from traditional middlebox interception and validation failures.
  • MCP security: MCP servers can forge tool outputs but cannot observe or alter upstream model reasoning, whereas malicious routers intercept every tool call and the full request context.This is the key structural difference identified between MCP and router placement.
  • Agent skills: Router attacks require no skill installation and affect both skill-enabled and skill-free clients.This contrasts them with vulnerabilities in installable agent skills and bundled scripts.

10 Conclusion

The study identifies LLM API routers as a critical trust boundary, finding malicious behavior and credential abuse among commodity routers and demonstrating that benign-looking routers can also be poisoned. Client-side defenses reduce exposure, but provider-signed response envelopes are needed to tie executed tool calls to model output.

  • Findings: 428 commodity routers yielded 9 injecting malicious code and 17 abusing researcher-owned credentials.The measurements covered paid and free routers, while poisoning studies exposed additional credential and token abuse.
  • Findings: Poisoning studies produced 2B billed tokens, 440 autonomous Codex sessions, and 99 leaked credentials.The decoy study found that 401 of the 440 sessions already ran in autonomous YOLO mode.
  • Ethics and scope: The study reports no IRB or equivalent ethics-board review and used researcher-controlled accounts, synthetic probing, and aggregate metadata from unauthorized third-party use.The authors characterize the work as ethically sensitive because it could attract abuse and cause nominal financial loss on researcher-owned accounts.
  • Disclosure scope: The study did not conduct provider-by-provider coordinated disclosure because its measurements concerned public router markets, communities, and researcher-controlled poisoning studies rather than a single private zero-day.This scope motivated the authors’ decision not to treat the findings as vendor-specific vulnerability disclosures.

A.2 Data Minimization

The study limits data collection and operational impact through researcher-controlled accounts, rate limits, non-interception, minimal exploitation, and nominal financial exposure. Because the techniques are dual-use, Mine is withheld while the authors argue that disclosure supports defensive safeguards.

  • Data minimization: All experimental API keys, accounts, and subscriptions were created for the research, while third-party traffic was retained only as aggregate metadata and hashed credential identifiers.Researcher-owned credentials were revoked or retired after observation, and logs are stored on encrypted infrastructure for deletion 12 months after publication.
  • Operational constraints: No provider received more than 60 requests per hour, and validation requests were spaced to avoid abuse-detection mechanisms.The stated rate remained below the published limits of all tested providers.
  • Operational constraints: The poisoning studies used researcher infrastructure and researcher-owned credentials rather than network interception, DNS hijacking, or traffic redirection.Traffic reached decoy relays voluntarily or followed publicly discoverable researcher-owned credentials.
  • Operational constraints: The researchers recorded potential weaknesses without additional real-world exploitation beyond the minimum needed to confirm their existence.They explicitly did not attempt to exploit, amplify, or reproduce discovered vulnerabilities further.
  • Dual-use mitigation: The single reported Ethereum drain lost less than US$50 because researcher-owned decoy keys held only nominal balances.The paper treats the attack taxonomy as dual-use and describes safeguards intended to limit misuse.
  • Dual-use mitigation: Mine is not publicly released, preserving measurement capability while raising the engineering barrier for misuse.The authors also frame public disclosure as defensively valuable because the attacks require straightforward JSON manipulation.

B Additional Defense Evaluation

The additional defense evaluation uses controlled, procedurally generated corpora and held-out sessions to assess anomaly screening, signed response envelopes, and related deployment choices. Results characterize threshold tradeoffs and position anomaly detection as a review aid rather than provenance.

  • Evaluation design: Defense results come from controlled artifact-side evaluation using procedurally generated benign and attack corpora with fixed command templates and random seeds.The evaluation is not based on field data.
  • Anomaly screening: The anomaly detector was fit on 2,000 benign tool calls and tested on 3,352 benign, 301 AC-1, 294 AC-1.a, and 53 AC-1.b calls.Only trigger-matching calls were labeled as AC-1.b attacks, leaving non-matching calls benign by construction.
  • Anomaly screening: AC-1 detection rises quickly with the false-positive budget, whereas AC-1.a and AC-1.b require more lenient thresholds.The threshold sweep exposes a tradeoff between detection behavior and false positives across attack variants.
  • Anomaly screening: Shell-risk patterns dominate detection for active command rewrites, so the anomaly detector remains a review aid rather than a substitute for provenance.This ablation result limits what response-side screening can establish about response authenticity.
  • Signed response envelopes: The signed response envelope covers the entire envelope except signature, while billing metadata, response identifiers, and transport headers remain unsigned.Tool-call arguments must be canonical native JSON, and ambiguous parsing must fail closed.
  • Signed response envelopes: Provider-side generation maps responses into the envelope, canonicalizes them with RFC 8785, and signs the canonical bytes with the private key named by key_id.Clients should execute tool calls only from the verified envelope, while routers may add unsigned outer metadata.
  • Signed response envelopes: For streaming responses, signing the final tool-bearing envelope targets the execution boundary without the complexity of signing every token chunk.The design addresses silent modification of the final tool-call payload.
Loading 2604.08407v1…