Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain
Hanzhi Liu, Chaofan Shou, Hongbo Wen, Yanju Chen, Ryan Jingyang Fang, Yu Feng
cs.CR
2026-04-10
UCSB measured 28 paid and 400 free LLM routers: 9 rewrote tool calls, 17 touched AWS canaries; weak decoys soaked up 2B tokens and 440 Codex sessions.
Tool-using agents now run shells, install packages, and touch cloud accounts. Production stacks rarely talk to OpenAI or Anthropic directly. They sit behind an LLM API router that does fallback, load balancing, and a single key for many providers. LiteLLM has about 40,000 GitHub stars and more than 240 million Docker Hub pulls. The commodity templates new-api and one-api each have more than a million pulls. Investigative reporting has documented Taobao shops with over 30,000 repeat purchases for resold API access.
A router is not a dumb pipe. The client points its base URL at the service on purpose. The router terminates TLS, then opens a separate upstream connection. Every hop sees plaintext JSON: system prompts, tool schemas, API keys, and the toolcall the agent will run. No deployed mechanism binds the provider's tool call to the payload the client finally executes. The March 2026 LiteLLM dependency-confusion incident made the risk concrete: a poisoned release gained write access to every request and response that transited the proxy.
The attacker runs a malicious router, or compromises a legitimate one through supply-chain, insider, or server-side access. The study sets aside prompt injection, model backdoors, and client malware. It tracks two orthogonal primitives.
Integrity is weakest-link across hops. One dishonest router taints the chain; honest routers downstream cannot see or undo the rewrite. AC-2 exposure adds up at every hop. A typical path can be four hops: a Taobao reseller, a second-tier aggregator, OpenRouter, then the model host. The client configures only the first hop.
The market study bought 28 paid OpenAI- and Anthropic-compatible routers from Taobao, Xianyu, and Shopify storefronts, and collected 400 free instances dominated by sub2api and new-api templates. Each router was driven from researcher accounts in a sandbox on custom tasks and TerminalBench 2.0, watching callbacks, filesystem changes, and process trees. Two poisoning studies then asked whether "benign" routers can be pulled into the same position: one OpenAI key was leaked on Chinese forums, WeChat, and Telegram; weak-password Sub2API, CLIProxyAPI, and claude-relay-service decoys were stood up on 20 domains and 20 IPs. Mine, an OpenAI-compatible FastAPI research proxy, implements all four attack classes against OpenClaw, OpenCode, Codex, and Claude Code, 1,000 tool-calling requests each.
The behavior is already in the wild.
| Setting | Sample | Active rewrite | Credential abuse |
| Paid routers | 28 | 1 injects malicious code | 0 observed |
| Free routers | 400 | 8 inject; 2 use conditional triggers | 17 touch AWS canaries; 1 drains ETH |
| Leaked upstream key | 1 OpenAI key | none observed | 100M GPT-5.4 tokens; more than 7 Codex sessions |
| Weak decoys | 20 domains + 20 IPs | all 440 sessions expose a shell path | 99 credentials across 398 projects/hosts; 401 already in YOLO |
The decoys are the louder signal: 40k+ unauthorized attempts from 147 IPs and 6 JA3 fingerprints; about 2B GPT-5.4 / 5.3-codex tokens and 13 GB of visible traffic. All 440 Codex sessions were command-injectable. For the 401 already auto-approving tools, a plain AC-1 rewrite would have been enough. The ETH drain was under US$50 at the time of transfer, a canary rather than loot. Leaked-key plus decoy traffic together is about 2.1B tokens.
Against the four public agent frameworks, 0/4 implement response-integrity checks. AC-1 rewrite compatibility is 100%; AC-1.a is 99.6%, with the remaining 0.4% being quoted fragments, editable local paths, and URL-based installs that the substitution rule declined. Streaming is handled by buffering until the full argument payload is present. Median proxy overhead is 0.013 ms against 820 ms median upstream latency.
Three client-side controls were evaluated on synthetic corpora, not production traffic:
| Defense | Coverage | Cost |
| Fail-closed high-risk tool policy gate | 100% of AC-1 and AC-1.a | 1.0% false positives, 2.3 μs median; 100% bypass when the payload lives on an allowlisted domain or a local stager |
| IsolationForest anomaly screen | 89.0% AC-1, 50.0% AC-1.a, 50.9% AC-1.b | 6.7% false positives; dropping the shell-risk feature collapses AC-1 to 17.6% |
| Append-only transparency log | audit only | 12.0 MB per 1,000 sessions, about 1.26 KB per entry |
At a 1% false-positive budget the screener still catches 43.5% of AC-1, 0% of AC-1.a, and 9.4% of AC-1.b. The longer-term gap is a provider-signed canonical response envelope, in the spirit of DKIM, covering model id, tool name, arguments, finish reason, and a client nonce. None of the major tool-use APIs or the current MCP spec ships that.
YOLO auto-approve, gray-market routers, and four-hop key reuse are common practice, not an edge case. Paying for a router improves uptime. It does not prove the toolcall was left alone. Prompt-level guards do not help: the rewrite sits in the JSON layer outside the model's reasoning loop.
What can ship today is a fail-closed allowlist on installer domains and package names, plus a local transparency log. Do not treat the anomaly detector as a standalone control. It is a review ranking, and an attacker who knows the feature family can stay inside ordinary shell syntax. Sandboxes such as E2B shrink blast radius after execution. They still do not prove the command came from the upstream model.
For providers the implication is sharper. Without a signed envelope, the tool call an agent executes has no origin. Routers routinely translate schemas, so the signature has to cover canonical JSON, not the raw HTTP body.
The corpus is the publicly reachable commodity market. Enterprise and invite-only deployments are out of sample. Finite black-box probing can catch a 50-request warm-up. It cannot rule out latent triggers the probes never hit. The authors say the two adaptive samples are not necessarily exhaustive.
Defense numbers are all from templated synthetic corpora; the IsolationForest was fit only on synthetic benign sessions. The 1.0% policy-gate false positives are installer fetches from mirror domains outside the local allowlist, so mirror-heavy developer setups would see more. The gate is bypassed on 100% of samples once the attacker uses an allowlisted domain or a pre-positioned local stager; the paper treats that as the main negative result of the defense section.
The ethics appendix is blunt: no IRB; no vendor-by-vendor coordinated disclosure, because sellers are anonymous, the gap is architectural, and telling one operator does not close it; Mine is not released; third-party prompts and bodies are not stored. The leaked-key study intentionally created publicly discoverable secrets and is framed as systems measurement, while conceding that the design invites third-party abuse. AC-2 happens on the request path, so response signing cannot stop it. Compatibility rates are not end-to-end execution rates: local permission prompts and sandboxes can still block a rewritten command.