A security study of 428 real-world LLM API routers found that third-party relay services can become a direct attack point in AI development workflows. Researchers identified 9 routers that actively injected malicious code, 17 that copied AWS canary credentials, and 1 router that stole ETH from a wallet planted by the research team.
The findings come from the arXiv paper Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain, authored by Hanzhi Liu, Chaofan Shou, Hongbo Wen, Yanju Chen, Ryan Jingyang Fang, and Yu Feng. The paper examines a common setup in which developers reach OpenAI, Anthropic, and other model providers through third-party LLM routers. In that design, TLS ends at the router, giving the intermediary full plaintext access to JSON payloads, including system prompts, chat history, API keys, and any private keys or credentials embedded in requests.
Four attack paths mapped out in the paper
The researchers formalized four classes of intermediary attacks. One is payload injection, where a router alters requests in transit and inserts malicious instructions or fake tool calls. Two evasive variants sit under that category: dependency-targeted injection, which adapts to the agent framework used by the client, and conditional delivery, which triggers only under specific timing, user, or content conditions. Another class is secret exfiltration, where sensitive data such as API keys, credentials, or private keys is silently copied during relay.
To test how these attacks work against real frameworks, the team built an evaluation agent called Mine and used it against public AI agent frameworks. The name captures the core concern of the study: developers may believe the agent is under their control, while the intermediary can quietly take over the workflow.
Both paid and free routers showed malicious behavior
Among the 428 routers, the team tested 28 paid routers and 400 free routers. Results showed that 1 paid router and 8 free routers actively injected malicious code. Another 2 routers used adaptive evasion methods, making their behavior harder to catch through short audits or static scans.
For credential theft testing, the researchers planted AWS canary credentials and observed that 17 routers touched those secrets, indicating collection of sensitive data in transit. In a separate case, 1 router used a planted private-key wallet to steal ETH, with losses below $50. The dollar amount was small. The onchain theft was real.
Leaked keys were consumed fast, with heavy use of YOLO mode
The paper also ran poisoning studies by intentionally exposing bait credentials to weakly configured routers and then tracking how stolen keys were abused. In one case, a stolen OpenAI API key burned through 100 million GPT-5.4 tokens before researchers could intervene, and it was used across more than 7 Codex sessions.
In a broader experiment, a larger pool of weakly configured bait credentials ended up consuming 2 billion billable tokens, spanning 99 credential sets and 440 Codex sessions. Of those, 401 sessions were running in autonomous YOLO mode. In tools such as Claude Code and Cursor, that mode allows the agent to execute terminal commands, read and write files, and call external APIs without human approval. The study argues that stolen credentials are not only a billing risk; they can also give attackers access to highly automated agent sessions that resemble an unsupervised remote execution environment.
Recommended defenses and the longer-term fix
The researchers outlined three client-side defenses: a fail-closed policy gate with allowlisted tool calls, response-side anomaly screening, and append-only transparency logging. They also argue these measures remain reactive, especially against routers that can change tactics. The longer-term fix proposed in the paper is cryptographic signing of model responses by providers, so clients can verify that outputs came from the model itself rather than being altered by an intermediary.
Until that becomes standard, the paper gives practical guidance: use official direct endpoints where possible, place strict human review gates around YOLO mode, and never pass private keys or seed phrases through AI agent sessions. For Web3 developers handling contract deployment, signing flows, and key management in the same toolchain, the paper frames this as an active operational risk rather than a theoretical one.