In a significant cybersecurity revelation, researchers have identified a critical vulnerability within the AI ecosystem that could allow attackers to manipulate AI agents, inject malicious code, and steal sensitive data at scale. Specifically, third-party AI router widely used as intermediaries between AI agents and model providers—have emerged as a major but often overlooked attack surface.

As organizations increasingly rely on AI agents to perform high-stakes operations such as executing code, managing cloud environments, and handling financial transactions, these systems depend heavily on LLM API routers. These routers route requests to providers like OpenAI, Anthropic, and Google. However, this convenience introduces serious security risks.

A recent study titled “Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain” by researchers from the University of California, Santa Barbara highlights how these routers create an unprotected trust boundary. Unlike traditional man-in-the-middle attacks that require TLS certificate manipulation, developers voluntarily configure these routers, giving them direct access to unencrypted data streams.

Consequently, these routers can intercept, read, modify, or even fabricate tool-call payloads without detection. Since no major AI provider currently enforces cryptographic integrity between the client and upstream model, attackers can easily rewrite commands executed by AI agents.

Malicious Code Injection and Exploitation

The researchers conducted an extensive investigation by purchasing 28 paid routers from online platforms and collecting 400 free routers from public communities. Their findings exposed alarming security gaps:

Ad Banner
  • 9 routers actively injected malicious code into tool calls.
  • 17 free routers triggered unauthorized usage of AWS credentials after intercepting them.
  • 1 router successfully drained Ethereum (ETH) from a private crypto wallet.
  • 2 routers deployed delayed or adaptive attacks, activating only after multiple interactions.

Notably, one dangerous technique—payload injection (AC-1)—replaces legitimate installer links or package names with attacker-controlled endpoints. Because the altered payload remains syntactically correct, it bypasses standard security checks. As a result, even a single manipulated command can lead to full system compromise.

Expanding Threat Surface

Furthermore, the study reveals that even seemingly safe routers can become compromised. After researchers intentionally leaked an API key on public forums, it generated massive unauthorized usage, exposing credentials across multiple sessions. In another experiment, decoy routers attracted over 40,000 unauthorized access attempts and exposed numerous credentials across hundreds of AI sessions.

Alarmingly, many of these sessions operated in autonomous “YOLO mode,” where commands execute automatically without human approval—significantly amplifying the risk.

Mitigation Strategies

Although no complete solution exists yet, researchers recommend several immediate safeguards:

  • Fail-closed policy gate: Restricts commands to a predefined allowlist.
  • Response anomaly detection: Identifies suspicious payloads using machine learning models.
  • Transparency logging: Enables forensic tracking of requests and responses.

Ultimately, experts emphasize the need for cryptographic response validation, similar to email authentication systems, to ensure the integrity of AI-generated actions.

Until providers like OpenAI and Anthropic introduce such safeguards, organizations must treat third-party routers as potential threats and adopt layered security defenses.

Recommended Cyber Technology News:

To participate in our interviews, please write to our CyberTech Media Room at info@intentamplify.com  



🔒 Login or Register to continue reading