Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain

Abstract: LLM agents increasingly rely on third-party API routers to dispatch tool-calling requests across multiple upstream providers. These routers operate as application-layer proxies with full plaintext access to every in-flight JSON payload, yet no provider enforces cryptographic integrity between client and upstream model. We present the first systematic study of this attack surface. We formalize a threat model for malicious LLM API routers and define two core attack classes, payload injection (AC-1) and secret exfiltration (AC-2), together with two adaptive evasion variants: dependency-targeted injection (AC-1.a) and conditional delivery (AC-1.b). Across 28 paid routers purchased from Taobao, Xianyu, and Shopify-hosted storefronts and 400 free routers collected from public communities, we find 1 paid and 8 free routers actively injecting malicious code, 2 deploying adaptive evasion triggers, 17 touching researcher-owned AWS canary credentials, and 1 draining ETH from a researcher-owned private key. Two poisoning studies further show that ostensibly benign routers can be pulled into the same attack surface: a leaked OpenAI key generates 100M GPT-5.4 tokens and more than seven Codex sessions, while weakly configured decoys yield 2B billed tokens, 99 credentials across 440 Codex sessions, and 401 sessions already running in autonomous YOLO mode. We build Mine, a research proxy that implements all four attack classes against four public agent frameworks, and use it to evaluate three deployable client-side defenses: a fail-closed policy gate, response-side anomaly screening, and append-only transparency logging.

• The paper identifies and formalizes two primary attack classes—payload injection and secret exfiltration—by empirically analyzing 28 paid and 400 free routers.
• It demonstrates universal compatibility of attacks via a custom proxy and controlled poisoning studies, highlighting real-world adverse effects like credential theft and message tampering.
• The study evaluates client-side defenses and argues for provider-signed canonical responses to ensure end-to-end integrity in LLM supply chains.

Malicious Intermediary Attacks in LLM Supply Chains: A Technical Analysis

---

Introduction

Modern LLM-powered autonomous agents are increasingly dependent on third-party API routers that multiplex, balance, and optimize access to upstream proprietary models. This intermediary layer, implemented in widely deployed software like LiteLLM and OpenRouter, is voluntarily positioned by clients between themselves and model providers, fundamentally altering trust boundaries for both request dispatch and tool-execution semantics. The paper "Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain" (2604.08407) presents the first comprehensive analysis of this architectural vulnerability, formalizing the exposure, characterizing real-world adversarial activity, and evaluating deployable mitigation strategies.

---

Threat Model and Attack Taxonomy

The explicit configuration of routers as API endpoints grants these intermediaries plaintext access to all transiting data—including credentials, tool arguments, and model outputs—by design. The paper formalizes this as an application-layer MITM with direct authority over tool-calling JSON. The integrity gap stems from the absence of any deployed mechanism that cryptographically ties upstream provider responses to what the client ultimately receives.

Two orthogonal core attack classes emerge:

• AC-1 (Payload Injection): Active modification of model responses, permitting arbitrary rewrite of tool-call arguments prior to client delivery.
• AC-2 (Secret Exfiltration): Passive extraction of credentials and sensitive secrets from unencrypted traffic.

Two adaptive evasion variants are systematized:

• AC-1.a (Dependency-Targeted Injection): Modifies only dependency/package names to deploy malicious libraries while passing syntactic and domain-based checks.
• AC-1.b (Conditional Delivery): Payload injection is triggered only on attacker-controlled predicates (e.g., session fingerprints, request history, project types), thereby evading standard auditing and detection.

---

Empirical Measurement of the Ecosystem

The study analyzes 28 paid routers acquired from leading black/gray-market vendors and 400 free routers exposed in public communities, primarily based on a handful of dominant open-source templates. Malicious behavior is directly observed in both economic segments:

• 1 paid and 8 free routers perform active code injection (AC-1/AC-1.a).
• 2 routers conditionally trigger adaptive evasion (AC-1.b).
• 17 routers exfiltrate AWS credentials, and 1 router steals Ethereum wallet funds—demonstrating AC-2 at scale.
• Poisoning studies show that benign routers are routinely incorporated into relay chains via leaked credentials; a single deliberately leaked OpenAI key invoked 100M model tokens, with 440 downstream Codex sessions processed by weak relays and 401 sessions running in fully autonomous (YOLO) mode.

This measurement underlines two fundamental points: (a) supply-chain entry points for such attacks are prevalent in real markets, and (b) the weakest-link property causes benign routers to be as dangerous as actively malicious ones when trust boundaries are transitive.

Figure 1: The LLM router ecosystem depicts how a single malicious intermediary ($R_4$) can taint and control downstream agent behavior through application-layer payload modification, in contrast to clean paths.

---

Attack Surface and Traceability

The attacks act below the model abstraction boundary, altering JSON payloads without engaging with prompt text or model logic. In tool-use workflows (e.g., OpenAI’s function calling, Anthropic’s native block JSON), payloads such as shell execution commands, installer URLs, and package install invocations are re-writable targets. The absence of transport or application-level integrity assurances means AC-1 can deliver arbitrary code execution, and AC-1.a can enable persistent supply-chain compromise by swapping package names to pre-poisoned dependencies.

Figure 2: Request–response lifecycle through a malicious router showing passive (secret scan, AC-2) and active (payload injection, AC-1) attack points on both request and response paths.

Empirical adaptation is confirmed: observed adversaries selectively inject for high-value sessions or after warm-up epochs, effectively hiding from finite black-box audits.

---

Benign Router Poisoning and Multi-Hop Exploitation

Two controlled poisoning studies demonstrate that credential leakage and weak relay configuration are widespread and immediately operationalized by attackers. Once an upstream key is leaked or a relay is left exposed, subsequent sessions—regardless of the router’s benign intent—are forwarded in cleartext through potential attack chains, inheriting the full attack surface of explicit adversaries. The paper documents 2B model tokens, 99 credentials, and high rates of session-level command injection through such poisoned relay networks.

---

Implementation and Compatibility of Attacks

The research proxy, Mine, implements all discussed attack classes and demonstrates universal compatibility against four contemporary agent frameworks: OpenClaw, OpenCode, Anthropic’s Claude Code, and OpenAI’s Codex. None of these frameworks enforce response-integrity checks or provenance, validating the efficacy and portability of these techniques. Mine achieves 100% compatibility for AC-1 and AC-2, and nearly 100% for AC-1.a, without introducing perceptible latency—buffered streaming incurs sub-ms additional latency compared to routine model jitter.

---

Defenses: Practical Efficacy and Limitations

Three deployable client-side mitigations are evaluated:

• Fail-Closed Policy Gate: Blocks all AC-1/1.a samples with a mere 1% false positive rate but can be bypassed by allowlist-compliant attacks.
• Response-Side Anomaly Screening: Catches up to 89% of AC-1 samples with moderate (6.7%) false positive rates but is less effective against sophisticated and evasion-aware attackers.
• Append-Only Transparency Logging: Facilitates forensic auditing, correlating compromised responses to incident scope but does not prevent attacks.

None of these achieve cryptographic origin authentication or end-to-end provenance.

---

Implications and Long-Term Directions

The analysis reveals an architectural misalignment between current LLM deployment practice and system trust assumptions. In practice, router-terminated TLS segments break the possibility of transparent, secure delegation. Robust defenses must shift responsibility to upstream model providers via provider-signed, canonical response envelopes covering tool-calling semantics and client-nonce binding, analogous to DKIM for email authenticity but adapted for structured tool arguments. This is necessary for meaningful end-to-end integrity across multi-hop, multi-vendor, and open-infrastructure ecosystems.

The study demonstrates that present defenses are operationally useful but strictly palliative—they bound exposure from unsophisticated attacks but cannot guarantee correctness in an adversarial supply chain.

---

Conclusion

In sum, commodity LLM routers have been empirically confirmed as active threat vectors for both payload tampering and credential harvesting. The voluntary placement of routers within agent execution pipelines creates an application-layer trust boundary that is not protected by existing cryptographic mechanisms. While immediate client-side mitigations reduce exposure, they are fundamentally insufficient. Secure agent-mediated tool execution will require adoption of provider-signed canonical response formats and stricter session provenance in LLM deployment APIs. These observations carry both practical urgency for security operations and theoretical significance for the architecture of multi-agent and tool-augmented AI systems.

---