Measuring Malicious Middleman Attacks in the LLM Supply Chain

LLM agents are increasingly relying on third-party API routers to send tool calls to multiple upstream providers. As an application-layer proxy, this router can see the plaintext of every in-flight JSON payload, but cryptographic integrity between the client and the upstream model is effectively not guaranteed.

Researchers were the first to systematize this attack surface, defining a threat model for malicious LLM API routers. There are two core attacks.

• AC-1 payload injection: injecting malicious code into requests in transit
• AC-2 secret exfiltration: stealing secrets mixed into requests/responses
• AC-1.a dependency-targeted injection: adaptive injection that targets dependencies
• AC-1.b conditional delivery: evasive delivery that sends malicious content only when conditions are met

The empirical findings were serious. Examining 28 paid routers purchased on Taobao, Xianyu, and Shopify storefronts, along with 400 free routers collected from public communities, researchers found that 1 paid router and 8 free routers were actually injecting malicious code, and 2 used adaptive evasion triggers. Additionally, 17 touched AWS canary credentials planted by the researchers, and 1 exfiltrated ETH from a private key owned by the researchers.

A further poisoning study showed that even seemingly benign routers can be drawn into the same attack surface. A single leaked OpenAI key generated 100M GPT-5.4 tokens and 7 or more Codex sessions, while a weakly configured decoy generated 2B billed tokens, 99 credentials, 440 Codex sessions, and 401 sessions already running in autonomous YOLO mode.

To validate this, researchers built a research proxy called Mine, implementing and evaluating four attack classes across four public agent frameworks. At the same time, they examined the practical effectiveness of client-side defenses including a fail-closed policy gate, response-side anomaly screening, and append-only transparency logging.