Skip to content

Back to the catalog

Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain
arxiv.orgpaper

Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain

Academic study formalizing a threat model for malicious third-party LLM API routers acting as plaintext proxies between agents and upstream model providers, defining payload-injection and secret-exfiltration attack classes with adaptive evasion variants. Testing 28 paid and 400 free routers, the authors found 9 injecting malicious code, 2 with evasion triggers, 17 touching planted AWS canary credentials, and 1 draining ETH from a planted private key, then built a research proxy named Mine to evaluate fail-closed policy gates, anomaly screening, and transparency logging as defenses.

TL;DR First systematic measurement of malicious LLM API routers hijacking agent tool calls to inject code or exfiltrate secrets, plus a research proxy and candidate defenses.
Open original ↗
Document

What it is

Academic paper (arXiv:2604.08407, April 2026) measuring malicious LLM API routers. The existing summary covers the threat model, the four attack classes, the router corpus, and the headline scan counts. What it doesn't carry: the real-world incident that motivates this, the multi-hop composition property, the poisoning-study numbers, the adaptive-evasion triggers, and — the part an engineer would act on — how well the proposed defenses actually work.

The concrete anchor: the LiteLLM incident

The paper is not purely hypothetical. It cites a March 2026 dependency-confusion compromise of LiteLLM (~40k GitHub stars, 240M+ Docker pulls), where attackers injected code into the request-handling pipeline of every deployment that pulled the poisoned release — giving that payload write access to every API request and response transiting the proxy. The same template family that powers commodity resold-API markets (new-api, one-api, sub2api) has been pulled millions of times.

The weakest-link chain property

The router path from client to GPU is composable and multi-hop — a Taobao reseller → aggregator → OpenRouter → host is four TLS terminations, and the client configures only the first. The paper formalizes chain integrity as weakest-link: a single malicious router at any hop can rewrite tool calls (AC-1) or collect secrets (AC-2), and downstream honest routers cannot detect or undo it because they hold no reference to the upstream original. For AC-2, taint is cumulative across every hop.

flowchart LR
  C[Client] --> R1[Router R1]
  R1 --> R4[Malicious R4]
  R1 --> R5[Honest R5]
  R4 -->|tainted response| R1
  R5 -->|clean| R1
  R4 -.-> P[Provider]
  R5 -.-> P

Poisoning-study numbers

Beyond scanning routers, the authors show benign routers get pulled into the attack surface via leaked keys and weak relays. A single intentionally leaked OpenAI key generated 100M GPT-5.4 tokens and 7+ Codex sessions. Weakly configured decoys (Sub2API, claude-relay-service, CLIProxyAPI) across 20 domains/20 IPs served ~2B tokens, exposed ~13 GB of prompt/response traffic, and leaked 99 credentials across 440 Codex sessions. Every one of the 440 was command-injectable and 401 already ran in autonomous "YOLO mode" — auto-approved tool execution, so simple injection sufficed without any adaptive trigger.

Adaptive evasion mechanics

Two routers deployed evasion in the wild: waiting for 50 prior calls before activating, restricting delivery to YOLO-mode sessions, or targeting only Rust and Go projects.

What to do

The paper evaluates three client-side defenses deployable without provider cooperation:

  • Fail-closed policy gate — blocks all AC-1 and AC-1.a shell-rewrite samples at 1.0% false positives.
  • Response-side anomaly screening — flags 89% of AC-1 samples, no provider changes needed.
  • Append-only transparency logging.

Caveats

The authors state these mitigations reduce exposure but do not close the gap: securing this ecosystem ultimately requires provider-backed response integrity cryptographically binding the executed tool call to what the upstream model produced. These attacks are orthogonal to prompt injection — they occur in the JSON/tool layer outside the model's reasoning loop — so they compose with, rather than replace, model-side safeguards.

Technologies named here

Techniques named here

Related in AI Security