Between every AI agent and the model it calls, there is often a router: a layer of software that handles cost arbitrage, latency optimisation, fallback logic, and access to models outside the major providers' walled gardens. That routing layer is used by millions of developers, embedded in enterprise infrastructure at significant scale, and trusted implicitly. A peer-reviewed study published this week finds it is not safe to trust implicitly.
The paper, "Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain" (Liu et al., arXiv:2604.08407), is the first systematic measurement of the router attack surface. Researchers audited 428 commodity routers sourced from paid API marketplaces and free model-sharing hubs including HuggingFace and GitHub. Among the findings: 17 routers accessed AWS canary credentials embedded in test environments, indicating active credential harvesting. Nine rewrote tool-call responses to inject malicious content. Two deployed adaptive evasion, triggering malicious behaviour only after 50 or more requests or when operating in autonomous agent mode. One drained Ethereum from a researcher test wallet.
The routing layer has grown rapidly because it solves real problems. OpenRouter, the dominant managed routing service, handles over one trillion tokens per day for more than one million registered developers, routing across more than 400 models. LiteLLM, the leading self-hosted alternative, sees 3.6 million daily downloads from PyPI and, per Wiz threat intelligence published in March, is present in 36 percent of cloud environments. Routers are attractive because they let developers access open-weight models, route dynamically to the cheapest available option at query time, and implement fallback and retry logic that individual model APIs do not provide.
The security problem is structural. Routers sit as man-in-the-middle between agent and model. When a router rewrites a tool-call response, the agent receives altered instructions and acts on them. The authors tested four widely deployed agent frameworks against what they call the AC-1 attack class. The four frameworks tested were OpenClaw, OpenCode, Codex, and Claude Code. All pass router-returned tool calls directly to execution. None implement cryptographic integrity checks on routing-layer responses. No major model provider currently signs responses at the transport layer.
The adaptive evasion finding is the most operationally significant. Two routers in the audit behaved cleanly for the first 50 requests before switching to malicious behaviour, and triggered only when the framework was detected as operating in autonomous mode. That behaviour is specifically designed to defeat the kind of spot-check auditing that security teams are most likely to perform on third-party infrastructure.
The paper does not name individual malicious routers or their operators. The research design mirrors what any developer building an agentic application would do: buying access to paid services and downloading freely available packages. The point is not that specific providers are bad actors, but that the category has no verification infrastructure, no signing standard, and no baseline of trust that enterprise buyers can check against.
For AI security teams, the implication is that the router is now part of the threat model in the same way that a compromised dependency would be. The controls that exist for software supply chain integrity (signing, provenance, reproducible builds) have no equivalent in the LLM routing layer. Until they do, every agent that routes through a third-party intermediary is operating on unverified instructions.
Source: Liu et al., arXiv:2604.08407
–
By the Control Plane Editorial Team