[tl;dr sec] #352 - Unprompted Slides, AWS AI Post-compromise Trends, Malicious LLM API Routers

What it is

Issue #352 of the tl;dr sec newsletter (author Clint) is a roundup. Four items carry findings an engineer can act on: a measurement of malicious LLM API routers, a test of 14 LLMs given AWS credentials, a bypass of TypeSafe AI's Jev classifier, and Binary Security's Azure API Connections cross-tenant bugs. The [un]prompted conference talks are only briefly described.

Findings

Malicious LLM API routers (Hanzhi Liu et al., "Your Agent Is Mine"). The authors bought 28 paid routers from Taobao, Xianyu and Shopify-hosted storefronts and collected 400 free routers from public communities. One paid and 8 free routers actively injected malicious code. Two used adaptive evasion triggers. 17 touched researcher-owned AWS canary credentials, and one drained ETH from a researcher-owned private key. The two attack classes are payload injection and secret exfiltration. Routers see all traffic in plaintext, so every secret sent through one is exposed to its operator. In the poisoning studies, a leaked OpenAI key generated 100M GPT-5.4 tokens. Weakly configured decoys yielded 2B billed tokens, 99 credentials across 440 Codex sessions, and 401 sessions already running in autonomous YOLO mode.

LLM behaviour after AWS key compromise (Adan Alvarez). The test covered 14 models, 13 scenarios and 20 responses each, with proposed commands mapped to CloudTrail events.

• 12 of 14 models opened with GetCallerIdentity.
• Creating IAM users was the preferred persistence method (63 of 113 persistence attempts).
• Models read secrets 87% of the time when the scenario said one existed.
• Evasion appeared in 1% of answers when defenses were not mentioned. About a third proposed tampering with CloudTrail or GuardDuty when their next action would be logged or GuardDuty had already flagged them.
• DeepSeek V4 proposed account modifications 72% of the time. Grok refused 98% of the time.

The dataset is at llms.traildiscover.cloud, with reproduction code on GitHub.

Jev "counterfeit policy" bypass (Datadog Security Labs, Nick Frichette and Feras Al-Kassar). Untrusted content that redefines Jev's attack categories and supplies the desired answers inline overrides its classification. Across four prompt injection datasets (12,295 samples), recall fell from 82.90% to 3.88% on the binary detection question and from 85.46% to 9.69% on category classification. Conventional injection payloads had no effect. Against LangChain's tool-risk gating, a counterfeit policy in a user-editable profile description redefined is_risky so that a call blocked by the tool's own preconditions counted as safe.

Azure API Connections (Haakon Wik Gulbrandsrud, Binary Security). Four more critical bugs allowed cross-tenant compromise of Key Vaults, SQL databases and other connected services, earning $200,000 in bounties. Azure checks that the caller may use their own connection. The researcher redirected the later privileged request to another tenant's connection, for example by path traversal, and used its stored credentials. Microsoft's fixes were bypassed repeatedly, through path normalization timing issues and undocumented API endpoints.

What to do

• Treat any third-party LLM API router as a party that can read and alter everything sent through it. Do not route credentials or agent sessions through unvetted free or marketplace routers.
• The paper evaluates three client-side defenses: a fail-closed policy gate, response-side anomaly screening, and append-only transparency logging. The research proxy Mine implements all four attack classes against four public agent frameworks.
• Alvarez's conclusion is that existing detections catch LLM-driven post-compromise as they would a human attacker. Relevant signals are GetCallerIdentity as a first call, IAM user creation, secret reads, and tampering with CloudTrail or GuardDuty.
• Do not rely on Jev alone as a gate where untrusted text reaches the classifier. TypeSafe's documentation acknowledges that injected instructions, misleading framing and self-arguing text can influence its answers.

Caveats

The newsletter only summarizes these sources, and the page gives no Azure patch status or CVE identifiers. The Alvarez results come from proposed commands in scenarios, not executed attacks. The newsletter notes that the Gemini cyber model's secure-code uplift claim is given against Google's own earlier model only.