Researchers Uncover Code Injections and Secret Exfiltration in Third-Party Large Language Model Routers
A new empirical study reveals that third-party LLM API routers frequently act as malicious intermediaries, silently intercepting prompts and exfiltrating tool secrets. Out of 428 examined routers, nine injected unauthorized code payloads while others siphoned cloud credentials and cryptocurrency keys.
Why it matters
API routers operate with full plaintext access to tool invocations, presenting a supply-chain vulnerability that bypasses standard client isolation.
TL;DR
- 01Nine out of 428 evaluated LLM routers were found actively injecting malicious code.
- 02Unattended agent sessions in YOLO mode were aggressively targeted in honeypot deployments.
- 03Researchers validated fail-closed gates, anomaly screening, and transparency logging as effective client-side mitigations.
The Intermediary Attack Surface
Third-party API aggregators and routing proxies operate with full plaintext access to every JSON body passing between developer workstations and upstream providers like OpenAI and Anthropic. A comprehensive evaluation of 428 routers (28 paid services sourced from online marketplaces and 400 free public proxies) identified widespread exploitation:
- 9 routers (1 paid, 8 free) actively injected malicious code into agent responses
- 2 routers deployed adaptive evasion mechanisms (
AC-1.adependency-targeted injection andAC-1.bconditional delivery) - 17 routers exfiltrated researcher-owned AWS canary credentials
- 1 rogue router drained Ethereum funds from a synthetic private key
Honeypots and Autonomous Exposure
The attack vector expands dramatically when agents operate in unsupervised environments. Poisoning trials revealed that a single leaked OpenAI key routed over 100M GPT-5.4 tokens across Codex instances. Weakly secured decoy environments attracted:
- 2,000,000,000 billed tokens
- 99 captured credentials across 440 Codex sessions
- 401 agent sessions actively executing in autonomous YOLO mode
Actionable Client-Side Defenses
To mitigate these intermediary risks, the researchers evaluated three deployable client-side defenses: 1. Fail-Closed Policy Gate: Enforces strict policy enforcement before tool actions execute. 2. Response-Side Anomaly Screening: Inspects and filters received model responses for unexpected anomalies. 3. Append-Only Transparency Logging: Maintains an immutable log of interactions to detect transit tampering.