First systematic study finds multiple LLM API routers injecting malicious code and stealing keys
Bedrovelsen · x · 2026-10-11
An arXiv paper presents the first systematic study of malicious LLM API routers: proxies that read all tool-calling payloads in plaintext, with no cryptographic integrity enforced between client and upstream model.
The authors formalize the threat model with two attack classes (payload injection AC-1, secret exfiltration AC-2) plus adaptive evasion variants. Testing 28 paid routers bought from Taobao, Xianyu and Shopify stores and 400 free routers, they found 1 paid and 8 free routers actively injecting malicious code, 2 using adaptive evasion triggers, 17 touching researcher-planted AWS canary credentials, and 1 draining ETH from a planted private key.
Honeypot studies show even benign-seeming routers get weaponized: a leaked OpenAI key consumed 100M GPT-5.4 tokens across 7+ Codex sessions, while weakly configured decoys yielded 2B billed tokens, 99 credentials across 440 sessions, with 401 sessions already running autonomously.
More from Safety
- Anthropic's deputy security chief warns AI-driven security crisis will worsen for ~18 months — ns123abc · 2026-10-23
- Downing Street hires AI adviser to prepare for AI's hit to entry-level graduate jobs — nordicinst · 2026-10-23
- MCP server turned rogue 30 days after approval, prompting open-source mcp-guard lockfile tool — ErgoniaWorks · 2026-10-23
- Argus launches to find card numbers and API keys leaked into tickets and comments — Scobleizer · 2026-10-23
- The 'antifragile internet' case: AI agents slash attack costs toward zero — rebeccakaden · 2026-10-23
- Microsoft: China-aligned hackers used ARTEX AI agents to hit 2,250+ M365 tenants — rickasaurus · 2026-10-23