{"id":24803,"date":"2026-10-10T20:37:37","date_gmt":"2026-10-10T20:37:37","guid":{"rendered":"https:\/\/www.securitytoday.de\/?p=24803"},"modified":"2026-10-16T06:53:15","modified_gmt":"2026-10-16T06:53:15","slug":"when-paid-ai-routers-inject-malware","status":"publish","type":"post","link":"https:\/\/www.securitytoday.de\/en\/2026\/10\/10\/when-paid-ai-routers-inject-malware\/","title":{"rendered":"When Paid AI Routers Inject Malicious Code"},"content":{"rendered":"<p><strong>Connecting AI agents to language models through an LLM router gives an intermediary plaintext access to every request and response. In testing, one paid router and eight free routers injected malicious code into tool calls; two routers adapted their behavior to evade detection. Routers, gateways and API keys therefore belong on security leaders\u2019 review checklists.<\/strong><\/p>\n<div style=\"background:#003340;color:#fff;padding:32px 36px;margin:32px 0;border-radius:8px;\">\n<p style=\"color:#69d8ed;text-transform:uppercase;letter-spacing:0.08em;font-size:0.82em;font-weight:700;margin:0 0 16px;\">Key Takeaways<\/p>\n<ul style=\"margin:0;padding-left:20px;line-height:1.7;\">\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Paid and free routers tampered with agent commands.<\/strong> One paid router and eight free routers injected malicious code into tool calls, while 17 routers accessed planted Amazon Web Services (AWS) credentials.<\/li>\n<li style=\"margin-bottom:10px;\"><strong style=\"color:#69d8ed;\">Self-hosted gateways are also targets.<\/strong> In March 2026, tampered LiteLLM versions appeared on the Python Package Index (PyPI); the PoeLLM campaign attacked servers through LiteLLM\u2019s default port, 4000.<\/li>\n<li style=\"margin-bottom:0;\"><strong style=\"color:#69d8ed;\">Client-side filters can be bypassed.<\/strong> A policy gate blocked every injection example in the benchmark, yet was bypassed entirely when malicious calls hid behind allowlisted domains.<\/li>\n<\/ul>\n<\/div>\n<p style=\"border-top:1px solid rgba(230,227,218,0.14);border-bottom:1px solid rgba(230,227,218,0.14);padding:14px 0;margin:28px 0;font-size:0.92em;color:#b8c5ce;\"><strong style=\"color:#69d8ed;\">Related:<\/strong> <a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/08\/wikimedia-reveals-traces-of-openai-agents\/\">Wikimedia reveals the traces left by OpenAI agents<\/a> &nbsp;\u00b7&nbsp; <a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/06\/cyber-insurance-evidence-policy-at-risk\/\">Cyber insurance: Without evidence, coverage is at risk<\/a><\/p>\n<h2>Delayed Injection in the Router<\/h2>\n<p>A router let <a href=\"https:\/\/arxiv.org\/html\/2604.08407v1\">an AI agent\u2019s first 50 requests<\/a> pass through unchanged. Only then did it inject malicious tool calls. Tool calls are the structured instructions a language model uses to make an agent act, for example by executing a shell command. A second router intervened only in sessions running in autonomous YOLO mode, in which the agent executes commands without asking for human confirmation. The project fingerprint also had to match Rust or Go.<\/p>\n<p>Both routers were among the findings from <a href=\"https:\/\/arxiv.org\/abs\/2604.08407\">a sample of 28 purchased routers and 400 routers collected free of charge<\/a>. The purchased routers came from Taobao, Xianyu and Shopify stores; the others came from public communities. One paid router and eight free routers actively injected malicious code into returned tool calls. Two routers used adaptive triggers to conceal their activity.<\/p>\n<p>A total of 17 routers accessed planted Amazon Web Services (AWS) canary credentials, meaning keys deliberately set up as bait. One router drained Ether (ETH) using an Ethereum private key created specifically for the experiment. The findings will be presented this month under the title \u201cYour Agent Is Mine\u201d at the ACM Conference on Computer and Communications Security in Salt Lake City. The authors include Hanzhi Liu and Yu Feng of the University of California, Santa Barbara, Chaofan Shou of Fuzzland and Ryan Jingyang Fang of World Liberty Financial.<\/p>\n<p><strong>What is an LLM router?<\/strong> A large language model (LLM) router is an intermediary service between an AI agent and one or more language models. It acts as an application proxy and sees every request and response as a plaintext JSON payload. Well-known examples include the open-source project LiteLLM and the OpenRouter service.<\/p>\n<h2>Plaintext Access Without Integrity Protection<\/h2>\n<p>LLM API routers act as application proxies. They receive requests from an agent, forward them to a language model and return the response. Every JSON payload is available in plaintext along the way. No provider enforces a cryptographic integrity binding between the client and the upstream model, the actual language model behind the router.<\/p>\n<p>The open-source router LiteLLM has around 40,000 GitHub stars and more than 240 million downloads on Docker Hub. It is integrated into production pipelines at thousands of organizations. OpenRouter connects users to more than 300 active models from over 60 providers.<\/p>\n<p>Since April, the first systematic threat model for malicious LLM API routers has identified four attack classes. Payload Injection (AC-1) inserts malicious instructions into responses. Secret Exfiltration (AC-2) steals credentials. Dependency-Targeted Injection (AC-1.a) targets a project&#8217;s dependencies. Conditional Delivery (AC-1.b) delivers malicious code only under specific conditions.<\/p>\n<h2>Leaked Keys as Bait<\/h2>\n<p>In two poisoning studies, the researchers deliberately planted bait. An OpenAI key was intentionally leaked in Chinese forums and in WeChat and Telegram groups. It generated 100 million GPT-5.4 tokens and more than seven Codex sessions. Tokens are the units of text that model providers use for billing.<\/p>\n<p>Poorly configured decoy routers processed a combined 2.1 billion billed tokens. Across 440 Codex sessions, 99 credentials were exposed. In 401 sessions, the agent was already operating autonomously in YOLO mode.<\/p>\n<h2>Self-Hosted Gateways Under Attack<\/h2>\n<p>In March 2026, attackers published tampered LiteLLM packages on PyPI, the Python Package Index, according to the <a href=\"https:\/\/docs.litellm.ai\/blog\/security-update-march-2026\">vendor<\/a>, likely using credentials obtained through the Trivy compromise. The malicious code entered the request pipeline of every installation that downloaded the poisoned release. From there, it could modify every API request and response passing through the proxy.<\/p>\n<p>LiteLLM also contained the command injection vulnerability <a href=\"https:\/\/www.sentinelone.com\/vulnerability-database\/cve-2026-42271\/\">CVE-2026-42271<\/a>. Two preview endpoints for the Model Context Protocol (MCP) allowed anyone holding a valid proxy API key to launch subprocesses. These ran on the proxy host with the privileges of the proxy process.<\/p>\n<p>Lumen\u2019s Black Lotus Labs had been tracking the PoeLLM malware campaign since April 2026. It affected <a href=\"https:\/\/www.lumen.com\/blog\/en-us\/canto-incognito-tracking-the-poellm-malware\">more than 3,400 servers<\/a>, with over 800 servers active per day at its peak. The campaign attacked targets through the default ports, 3000 for Gotenberg and 4000 for LiteLLM. It concealed the address of its command-and-control (C2) server in a poem on GitHub, whose first commit was dated 13 April 2026. According to a Black Lotus Labs report dated 7 October, the campaign has since been disrupted.<\/p>\n<h2>Limitations of Countermeasures<\/h2>\n<p>A fail-closed policy gate checks every tool call against a set of rules and blocks it when in doubt. In a benchmark comprising 1,000 benign shell commands, 500 AC-1 commands and 500 AC-1.a commands, it blocked all injection examples with a 1.0 percent false-positive rate. It was completely bypassed when malicious calls were concealed behind allowlisted domains (the list of permitted destinations) or a pre-positioned local stager. A stager is a small initial program that downloads additional malicious code.<\/p>\n<p>The adaptive evasion used by the two observed routers makes brief black-box testing harder: they deliver malicious code only after a warm-up period or when specific session characteristics are present. Response-side anomaly screening flagged 89.0 percent of AC-1 examples at a 6.7 percent false-positive rate. For AC-1.a, the detection rate was 50.0 percent; for AC-1.b, it was 50.9 percent.<\/p>\n<p>AEGIS takes a different approach. <a href=\"https:\/\/arxiv.org\/abs\/2606.16358\">Submitted in June<\/a> by a team including Sipeng Xie, the proposal describes an attested API router. The client verifies a hardware enclave before releasing plaintext. This enclave is an isolated area within the processor, known as a Trusted Execution Environment (TEE). According to the authors, all four classes of router attacks fail, including in adaptive tests. The overhead is approximately six milliseconds per request, and the trusted path comprises 851 lines of code.<\/p>\n<h2 style=\"padding-top:64px;margin-bottom:20px;\">Frequently Asked Questions<\/h2>\n<p class=\"st-faq-hint\">Every question is locked. A tap unlocks the answer.<\/p>\n<details>\n<summary><strong>Which agent frameworks are vulnerable to attacks via a compromised router?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">The research proxy \u201cMine\u201d implements all four attack classes against four publicly available agent frameworks: OpenClaw, OpenCode, OpenAI Codex and Anthropic Claude Code.<\/p>\n<\/details>\n<details>\n<summary><strong>Which LiteLLM versions are affected by CVE-2026-42271?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">Versions from 1.74.2 up to, but not including, 1.83.7 are affected. Version 1.83.7 fixes the vulnerability. The flaw is classified as CWE-77, the Common Weakness Enumeration category for command injection.<\/p>\n<\/details>\n<details>\n<summary><strong>How can a transparency log help protect against tampered routers?<\/strong><\/summary>\n<p style=\"margin:8px 0 4px 24px;color:#555;line-height:1.6;\">An append-only transparency log does not prevent tampering. It preserves evidence for forensic investigation. Append-only means entries can only be added and cannot be modified afterward.<\/p>\n<\/details>\n<aside data-element=\"sources\">\n<details class=\"evm-sources\">\n<summary>Sources and reporting dates <span class=\"evm-sources-count\">(6)<\/span><\/summary>\n<ul>\n<li><a href=\"https:\/\/arxiv.org\/html\/2604.08407v1\" rel=\"noopener\" target=\"_blank\">arxiv.org: Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain, April 2026<\/a><\/li>\n<li><a href=\"https:\/\/arxiv.org\/abs\/2604.08407\" rel=\"noopener\" target=\"_blank\">arXiv.org: Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain, April 2026<\/a><\/li>\n<li><a href=\"https:\/\/docs.litellm.ai\/blog\/security-update-march-2026\" rel=\"noopener\" target=\"_blank\">docs.litellm.ai: Security Update: Suspected Supply Chain Incident | liteLLM<\/a><\/li>\n<li><a href=\"https:\/\/www.sentinelone.com\/vulnerability-database\/cve-2026-42271\/\" rel=\"noopener\" target=\"_blank\">SentinelOne: CVE-2026-42271: Litellm Litellm RCE Vulnerability, May 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.lumen.com\/blog\/en-us\/canto-incognito-tracking-the-poellm-malware\" rel=\"noopener\" target=\"_blank\">lumen.com: Canto incognito: tracking the PoeLLM malware, October 2026<\/a><\/li>\n<li><a href=\"https:\/\/arxiv.org\/abs\/2606.16358\" rel=\"noopener\" target=\"_blank\">arXiv.org: The Proxy Knows Too Much: Sealing LLM API Routers with Attested TEEs, June 2026<\/a><\/li>\n<\/ul>\n<\/details>\n<\/aside>\n<p><!--ST-LOWER-CARDS lang=en--><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">Editor&#8217;s Picks<\/h3>\n<p><a href=\"https:\/\/www.securitytoday.de\/en\/2026\/10\/09\/when-the-penetration-testing-agent-switches-sides\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><span style=\"display:flex;align-items:center;justify-content:center;width:100%;height:100%;color:rgba(105,216,237,0.5);font-size:1.4em;\">&#9635;<\/span><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#69d8ed;margin-bottom:5px;\">Editor&#8217;s Pick<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">When the Penetration Testing Agent Switches Sides<\/span><\/span><\/a><\/p>\n<h3 style=\"margin:48px 0 18px;font-size:1.05em;font-weight:800;color:#e6e3da;line-height:1.2;\">More from the MBF Media Network<\/h3>\n<p><a href=\"https:\/\/www.cloudmagazin.com\/en\/2026\/09\/03\/openai-terminates-cursors-model-access\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><span style=\"display:flex;align-items:center;justify-content:center;width:100%;height:100%;color:rgba(105,216,237,0.5);font-size:1.4em;\">&#9635;<\/span><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#0bb7fd;margin-bottom:5px;\">cloudmagazin<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">OpenAI Pulls the Plug on Cursor: Your Own Key as Plan B<\/span><\/span><\/a><a href=\"https:\/\/mybusinessfuture.com\/en\/e-invoicing-three-key-decisions-for-the-mittelstand\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><span style=\"display:flex;align-items:center;justify-content:center;width:100%;height:100%;color:rgba(105,216,237,0.5);font-size:1.4em;\">&#9635;<\/span><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#aa8ac2;margin-bottom:5px;\">MyBusinessFuture<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">E-invoicing: Three decisions for the Mittelstand<\/span><\/span><\/a><a href=\"https:\/\/www.digital-chiefs.de\/en\/model-harness-instead-of-model-marriage-who-controls-the-ai-chain\/\" style=\"display:flex;align-items:center;gap:14px;padding:12px 14px;margin:0 0 10px;background:#23261f;border:1px solid rgba(105,216,237,0.18);border-radius:12px;box-shadow:0 6px 18px rgba(0,0,0,0.22);text-decoration:none;color:#e6e3da;box-sizing:border-box;width:100%;\"><span style=\"flex:0 0 116px;aspect-ratio:16\/9;overflow:hidden;border-radius:8px;background:#111210;border:1px solid rgba(230,227,218,0.08);display:block;\"><span style=\"display:flex;align-items:center;justify-content:center;width:100%;height:100%;color:rgba(105,216,237,0.5);font-size:1.4em;\">&#9635;<\/span><\/span><span style=\"display:block;min-width:0;\"><span style=\"display:block;font-size:0.68em;font-weight:700;letter-spacing:0.1em;text-transform:uppercase;color:#e8828d;margin-bottom:5px;\">Digital Chiefs<\/span><span style=\"display:block;font-size:1.0em;font-weight:650;line-height:1.35;color:#e6e3da;overflow-wrap:anywhere;\">Model Harness Instead of Model Marriage: Who Controls the AI Chain?<\/span><\/span><\/a><!--\/ST-LOWER-CARDS--><\/p>\n<p style=\"font-style:italic;text-align:right;font-size:0.85em;margin-top:8px;\">Image source: AI-generated (October 2026)<\/p>\n","protected":false},"excerpt":{"rendered":"One paid and eight free LLM routers injected malicious code into AI agents in a test. A filter with a perfect detection rate can still be bypassed.","protected":false},"author":10,"featured_media":24703,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"LLM routers","_yoast_wpseo_title":"When Paid AI Routers Inject Malicious Code","_yoast_wpseo_metadesc":"One paid and eight free LLM routers injected malware into AI agents in tests. A filter with a perfect detection rate can still be bypassed.","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_meta-robots-adv":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"_evm_slot_owner":"","evm_cvss":0,"evm_risk":0,"evm_casefile":"","evm_primary_cve":"","evm_pin_until":0,"evm_external_preview_token":"","evm_external_preview_expires":"","_evm_translation_lang":"en","featured_post":0,"featured_post_sortierung":0,"_wp_old_slug":[],"footnotes":""},"categories":[259],"tags":[],"class_list":["post-24803","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-strategie-governance-en"],"evm_reading_time_minutes":8,"wpml_language":"en","wpml_translation_of":24701,"_links":{"self":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24803","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/comments?post=24803"}],"version-history":[{"count":5,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24803\/revisions"}],"predecessor-version":[{"id":24994,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/posts\/24803\/revisions\/24994"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media\/24703"}],"wp:attachment":[{"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/media?parent=24803"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/categories?post=24803"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.securitytoday.de\/en\/wp-json\/wp\/v2\/tags?post=24803"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}