Malicious LLM router attack visualization showing AI data interception and crypto theft

Your Agent Is Mine: How Malicious LLM Routers Are Stealing Crypto and Credentials at Scale

Imagine trusting an AI agent to handle your crypto transactions, only to discover that every command passed through an invisible intermediary that was silently rewriting your instructions and draining your wallet. This is not a hypothetical threat - it is happening right now.

Researchers from the University of California, Santa Barbara and UC San Diego have uncovered a critical vulnerability in the AI agent ecosystem that exposes millions of users to credential theft, financial loss, and complete system compromise. Their findings reveal that 26 LLM routers are actively injecting malicious tool calls and stealing credentials, with one attack already draining $500,000 from a client wallet.

The Hidden Threat in Your AI Supply Chain

AI agents have evolved far beyond simple chatbots. They now book flights, execute code, manage cloud infrastructure, and handle financial transactions on behalf of users. But there is a dangerous blind spot in this architecture: the LLM API routers that sit between users and AI models.

These routers act as application-layer proxies with full plaintext access to every message passing through them. When you send a request to OpenAI, Anthropic, or Google through a third-party router, that intermediary terminates your TLS connection and re-originates a new one upstream. This places the router in a perfect position to read, modify, or fabricate any tool-call payload without detection.

Unlike traditional man-in-the-middle attacks that require certificate forgery, these intermediaries are configured voluntarily by developers as their API endpoints. You think you are talking directly to a reputable AI model. In reality, your most sensitive data is passing through infrastructure you have never audited.

The $500,000 Wake-Up Call

The research team, led by Chaofan Shou, conducted a comprehensive study of the LLM router ecosystem. They purchased 28 paid routers from platforms like Taobao, Xianyu, and Shopify-hosted storefronts. They collected 400 free routers from public communities. The results were chilling.

Nine routers actively injected malicious code into returned tool calls. Eight of these were free services luring users with cheap API access while secretly compromising their systems.

Seventeen free routers triggered unauthorized use of researcher-owned AWS credentials after intercepting them in transit. These credentials were harvested and exploited without the researchers' knowledge.

One router drained ETH from a researcher-controlled Ethereum private key. While the test amount was small, the attack vector was proven. As Shou stated on X: "26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet."

The researchers also demonstrated how easily the attack scales. By poisoning parts of the router ecosystem - essentially tricking services into forwarding traffic to them - they were able to observe and potentially control hundreds of downstream systems within hours. A single malicious router in the chain is enough to compromise the entire system.

How the Attacks Work

The research paper "Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain" identifies four primary attack vectors:

Payload Injection (AC-1)

This attack replaces a benign installer URL or package name with an attacker-controlled endpoint. Because the tampered JSON payload remains syntactically valid, it passes schema validation and clears most automated security checks. A single rewritten curl command is enough to achieve arbitrary code execution on the client machine.

Credential Exfiltration (AC-2)

Routers simply collect secrets passing through them. Private keys, API tokens, database credentials, and cloud access keys all travel in plaintext through these intermediaries. Once exposed, credentials can be copied and reused without the user's knowledge.

Adaptive Evasion (AC-3)

Two routers in the study deployed sophisticated evasion techniques. They activated malicious payloads only after 50 prior requests, making detection difficult. They specifically targeted autonomous "YOLO mode" sessions running Rust or Go projects, where tool execution is auto-approved without per-command confirmation.

Router Poisoning (AC-4)

Even ostensibly benign routers can be weaponized. The researchers demonstrated this by intentionally leaking a single OpenAI API key on Chinese forums. That key generated 100 million GPT-5.4 tokens and exposed credentials across multiple downstream Codex sessions. In a second poisoning study, weak router decoys attracted 40,000 unauthorized access attempts, served roughly 2 billion billed tokens, and exposed 99 credentials across 440 sessions spanning 398 different projects.

The YOLO Mode Problem

Many AI agent frameworks include a setting called "YOLO mode" where the agent executes commands automatically without asking the user to confirm each one. This is convenient for productivity but catastrophic for security.

The researchers found that 401 of the 440 compromised sessions were already running in YOLO mode. When a malicious router injects a payload in this configuration, there is no human in the loop to catch the attack. The agent simply executes the modified command, and the damage is done before anyone realizes what happened.

This creates a dangerous feedback loop. Users enable YOLO mode to be more productive. Attackers target YOLO mode because it removes the last line of defense. The result is a security disaster waiting to happen.

Why This Threat Is Different

Traditional supply chain attacks target software dependencies or compromised repositories. This attack is more insidious because it targets the communication channel itself. You cannot audit your way out of this problem because the vulnerability is not in the code you run - it is in the infrastructure you use to communicate.

The boundary between "credential handling" and "credential theft" is invisible to the client because routers already read secrets in plaintext as part of normal forwarding. You have no way to know if your router is malicious or benign. You have no way to verify that the response you receive actually came from the AI model you intended to query.

No major AI provider currently enforces cryptographic integrity between client and upstream model. There is nothing to prevent a malicious router from rewriting the exact command an agent executes. The trust model is fundamentally broken.

The Scale of the Problem

The LLM router market has exploded. Investigative reporting documents Taobao merchants with over 30,000 repeat purchases for LLM API keys. Open-source router templates like new-api and one-api have been pulled millions of times from Docker Hub and GitHub.

These services appeal to users who want cheaper access to AI models or need to route requests across multiple providers. But they introduce an invisible attack surface that most developers do not even know exists.

The researchers warn that this is a weakest-link problem. Even if you trust your AI provider, the infrastructure in between may not be trustworthy. And because these systems can operate autonomously - frequently approving and executing actions without human review - a single altered instruction can immediately compromise systems or funds.

Immediate Defensive Measures

While no client-side defense can fully authenticate the provenance of a returned tool call, the researchers recommend three mitigations for immediate deployment:

Fail-Closed Policy Gate

Block all shell-rewrite and dependency-injection attacks by only allowing commands from a local allowlist. This achieves a 1.0% false positive rate, though it can be bypassed if attackers host payloads on allowlisted domains.

Response-Side Anomaly Screening

Flag suspicious tool calls using an IsolationForest model trained on benign patterns. This catches 89% of payload injection attempts with a 6.7% false positive budget.

Append-Only Transparency Logging

Record full request/response metadata, TLS data, and response hashes to enable forensic scoping after an incident. This stores only about 1.26 KB per entry and provides the evidence needed to detect and investigate attacks.

The Long-Term Fix: Cryptographic Verification

The research team argues that closing this provenance gap ultimately requires provider-signed response envelopes. This mechanism would be analogous to DKIM for email - cryptographically binding the tool call an agent executes to the upstream model's actual output.

Until major providers like OpenAI and Anthropic implement such response-integrity mechanisms, developers deploying AI agents via third-party routers should treat every intermediary as a potential adversary and implement layered client-side defenses accordingly.

What You Should Do Right Now

If you are using AI agents for any task involving sensitive data or financial transactions, take these steps immediately:

The Bigger Picture

This research exposes a fundamental tension in the AI agent ecosystem. The industry is racing toward a future where AI agents handle trillions of dollars in transactions. McKinsey projects that AI agents could mediate $3 trillion to $5 trillion of global consumer commerce by 2030. Coinbase founder Brian Armstrong predicts there will soon be more AI agents than humans making transactions on the internet.

But the infrastructure underpinning this shift is not secure. The trust boundaries that protect traditional software systems do not exist in the AI agent supply chain. And the consequences of compromise are far more severe when agents have direct access to financial systems and critical infrastructure.

The researchers have done the community a service by exposing these vulnerabilities before they are exploited at scale. But awareness is not enough. The industry must move quickly to implement cryptographic verification, improve supply chain transparency, and establish security standards for AI agent infrastructure.

Until then, every AI agent deployment is a potential attack vector. Every third-party router is a potential adversary. And every transaction is a potential theft waiting to happen.

Frequently Asked Questions

What is an LLM router and why is it dangerous?

An LLM router is an intermediary service that sits between users and AI model providers like OpenAI or Anthropic. It is dangerous because it has full plaintext access to every message passing through it, including sensitive credentials and commands. Malicious routers can modify requests and responses without detection.

How can I tell if my AI agent is using a third-party router?

Check your API configuration. If your API endpoint is not directly from the provider (like api.openai.com), you are likely using a router. Services offering discounted API access often route through intermediaries. Review your environment variables and configuration files for non-standard endpoints.

What is YOLO mode and why should I disable it?

YOLO mode is a setting in many AI agent frameworks that allows the agent to execute commands automatically without asking for user confirmation. You should disable it because it removes the last line of defense against malicious payload injection. With YOLO mode enabled, a compromised router can execute arbitrary code without any human oversight.

Can I still use AI agents for crypto transactions safely?

You can reduce risk by using direct API access to major providers, disabling automatic execution modes, implementing command allowlists, and never exposing private keys to AI agent sessions. However, the fundamental vulnerability remains until providers implement cryptographic response verification.

What are the signs that a router may be compromised?

Signs include unexpected command execution, unauthorized API calls using your credentials, network traffic to unknown endpoints, or modified responses that do not match your expectations. However, sophisticated attackers may leave no visible traces, making prevention more important than detection.

How does router poisoning work?

Router poisoning involves tricking benign routers into forwarding traffic to attacker-controlled infrastructure. This can be done by leaking credentials, exploiting configuration weaknesses, or compromising the router software itself. Once poisoned, the router becomes a malicious intermediary without the operator's knowledge.

Are paid routers safer than free ones?

The research found that malicious routers existed in both paid and free categories. Eight of the nine malicious code injectors were free services, but paid services are not immune. Price is not a reliable indicator of security. Only direct provider access or cryptographic verification can ensure integrity.

What should I do if I suspect my credentials have been compromised?

Immediately revoke and rotate all potentially exposed credentials. Review access logs for unauthorized activity. Implement the defensive measures outlined in this article before resuming AI agent operations. Consider engaging a security professional for incident response.

When will AI providers fix this vulnerability?

There is no timeline for cryptographic response verification from major providers. The research team has published their findings to encourage industry action. Until providers implement signed response envelopes, users must rely on client-side defenses and avoid third-party routers when possible.

Is this vulnerability being actively exploited?

Yes. The research documented 26 routers actively injecting malicious code and stealing credentials. The $500,000 wallet drain proves real-world exploitation is occurring. As AI agents handle more financial transactions, attacks are likely to increase in frequency and sophistication.

Conclusion

The discovery of malicious LLM routers represents a watershed moment for AI agent security. It exposes a vulnerability that affects every user of third-party AI infrastructure and demonstrates that the current trust model is fundamentally broken.

The good news is that awareness is the first step toward protection. By understanding how these attacks work and implementing the defensive measures outlined here, you can significantly reduce your risk exposure.

The bad news is that comprehensive protection requires industry-wide changes that have not yet materialized. Until AI providers implement cryptographic verification of responses, users must remain vigilant and treat every intermediary as a potential threat.

Your AI agent is only as secure as the supply chain it relies on. Choose that chain carefully.

Stay informed about the latest AI security threats. Subscribe to our newsletter for weekly updates on vulnerabilities, exploits, and defensive strategies.