Paper reveals malicious intermediary attacks in LLM supply chain stealing keys and funds

elie · x · 2026-08-24

A paper titled "Your Agent Is Mine" presents the first systematic study of malicious intermediary attacks within the LLM supply chain. Investigating 28 paid and 400 free third-party LLM API routers, researchers discovered real-world malicious activities, including code injection, cloud credential theft, and cryptocurrency wallet draining. Attackers exploit the lack of cryptographic integrity enforcement between clients and upstream providers, executing attacks via payload injection and secret exfiltration. The study highlights that every intermediary between an agent and a model is part of the security boundary, amplifying supply chain risks.

Original post →

More from Safety

Safety channel →