When Paid AI Routers Inject Malicious Code

Connecting AI agents to language models through an LLM router gives an intermediary plaintext access to every request and response. In testing, one paid router and eight free routers injected malicious code into tool calls; two routers adapted their behavior to evade detection. Routers, gateways and API keys therefore belong on security leaders’ review checklists.

Related: Wikimedia reveals the traces left by OpenAI agents  ·  Cyber insurance: Without evidence, coverage is at risk

Delayed Injection in the Router

A router let an AI agent’s first 50 requests pass through unchanged. Only then did it inject malicious tool calls. Tool calls are the structured instructions a language model uses to make an agent act, for example by executing a shell command. A second router intervened only in sessions running in autonomous YOLO mode, in which the agent executes commands without asking for human confirmation. The project fingerprint also had to match Rust or Go.

Both routers were among the findings from a sample of 28 purchased routers and 400 routers collected free of charge. The purchased routers came from Taobao, Xianyu and Shopify stores; the others came from public communities. One paid router and eight free routers actively injected malicious code into returned tool calls. Two routers used adaptive triggers to conceal their activity.

A total of 17 routers accessed planted Amazon Web Services (AWS) canary credentials, meaning keys deliberately set up as bait. One router drained Ether (ETH) using an Ethereum private key created specifically for the experiment. The findings will be presented this month under the title “Your Agent Is Mine” at the ACM Conference on Computer and Communications Security in Salt Lake City. The authors include Hanzhi Liu and Yu Feng of the University of California, Santa Barbara, Chaofan Shou of Fuzzland and Ryan Jingyang Fang of World Liberty Financial.

What is an LLM router? A large language model (LLM) router is an intermediary service between an AI agent and one or more language models. It acts as an application proxy and sees every request and response as a plaintext JSON payload. Well-known examples include the open-source project LiteLLM and the OpenRouter service.

Plaintext Access Without Integrity Protection

LLM API routers act as application proxies. They receive requests from an agent, forward them to a language model and return the response. Every JSON payload is available in plaintext along the way. No provider enforces a cryptographic integrity binding between the client and the upstream model, the actual language model behind the router.

The open-source router LiteLLM has around 40,000 GitHub stars and more than 240 million downloads on Docker Hub. It is integrated into production pipelines at thousands of organizations. OpenRouter connects users to more than 300 active models from over 60 providers.

Since April, the first systematic threat model for malicious LLM API routers has identified four attack classes. Payload Injection (AC-1) inserts malicious instructions into responses. Secret Exfiltration (AC-2) steals credentials. Dependency-Targeted Injection (AC-1.a) targets a project’s dependencies. Conditional Delivery (AC-1.b) delivers malicious code only under specific conditions.

Leaked Keys as Bait

In two poisoning studies, the researchers deliberately planted bait. An OpenAI key was intentionally leaked in Chinese forums and in WeChat and Telegram groups. It generated 100 million GPT-5.4 tokens and more than seven Codex sessions. Tokens are the units of text that model providers use for billing.

Poorly configured decoy routers processed a combined 2.1 billion billed tokens. Across 440 Codex sessions, 99 credentials were exposed. In 401 sessions, the agent was already operating autonomously in YOLO mode.

Self-Hosted Gateways Under Attack

In March 2026, attackers published tampered LiteLLM packages on PyPI, the Python Package Index, according to the vendor, likely using credentials obtained through the Trivy compromise. The malicious code entered the request pipeline of every installation that downloaded the poisoned release. From there, it could modify every API request and response passing through the proxy.

LiteLLM also contained the command injection vulnerability CVE-2026-42271. Two preview endpoints for the Model Context Protocol (MCP) allowed anyone holding a valid proxy API key to launch subprocesses. These ran on the proxy host with the privileges of the proxy process.

Lumen’s Black Lotus Labs had been tracking the PoeLLM malware campaign since April 2026. It affected more than 3,400 servers, with over 800 servers active per day at its peak. The campaign attacked targets through the default ports, 3000 for Gotenberg and 4000 for LiteLLM. It concealed the address of its command-and-control (C2) server in a poem on GitHub, whose first commit was dated 13 April 2026. According to a Black Lotus Labs report dated 7 October, the campaign has since been disrupted.

Limitations of Countermeasures

A fail-closed policy gate checks every tool call against a set of rules and blocks it when in doubt. In a benchmark comprising 1,000 benign shell commands, 500 AC-1 commands and 500 AC-1.a commands, it blocked all injection examples with a 1.0 percent false-positive rate. It was completely bypassed when malicious calls were concealed behind allowlisted domains (the list of permitted destinations) or a pre-positioned local stager. A stager is a small initial program that downloads additional malicious code.

The adaptive evasion used by the two observed routers makes brief black-box testing harder: they deliver malicious code only after a warm-up period or when specific session characteristics are present. Response-side anomaly screening flagged 89.0 percent of AC-1 examples at a 6.7 percent false-positive rate. For AC-1.a, the detection rate was 50.0 percent; for AC-1.b, it was 50.9 percent.

AEGIS takes a different approach. Submitted in June by a team including Sipeng Xie, the proposal describes an attested API router. The client verifies a hardware enclave before releasing plaintext. This enclave is an isolated area within the processor, known as a Trusted Execution Environment (TEE). According to the authors, all four classes of router attacks fail, including in adaptive tests. The overhead is approximately six milliseconds per request, and the trusted path comprises 851 lines of code.

Frequently Asked Questions

Every question is locked. A tap unlocks the answer.

Which agent frameworks are vulnerable to attacks via a compromised router?

The research proxy “Mine” implements all four attack classes against four publicly available agent frameworks: OpenClaw, OpenCode, OpenAI Codex and Anthropic Claude Code.

Which LiteLLM versions are affected by CVE-2026-42271?

Versions from 1.74.2 up to, but not including, 1.83.7 are affected. Version 1.83.7 fixes the vulnerability. The flaw is classified as CWE-77, the Common Weakness Enumeration category for command injection.

How can a transparency log help protect against tampered routers?

An append-only transparency log does not prevent tampering. It preserves evidence for forensic investigation. Append-only means entries can only be added and cannot be modified afterward.

Editor’s Picks

▣Editor’s PickWhen the Penetration Testing Agent Switches Sides

More from the MBF Media Network

▣cloudmagazinOpenAI Pulls the Plug on Cursor: Your Own Key as Plan B▣MyBusinessFutureE-invoicing: Three decisions for the Mittelstand▣Digital ChiefsModel Harness Instead of Model Marriage: Who Controls the AI Chain?

Image source: AI-generated (October 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.