Crypto Heist: LLM Routers Exposed as Sneaky Thieves in Shocking New Study!

by

So, buckle up! A new study from the fine folks at arXiv reveals that 26 LLM API routers are channeling their inner Robin Hood-but instead of giving to the poor, they’re draining ETH wallets dry. Welcome to the hidden drama of AI coding agents!

The AI coding tools you trust every single day? Yeah, they might just be playing a little game of “Who Wants to Steal Your Crypto?” A peer-reviewed study published on arXiv has uncovered a serious attack surface lurking within the LLM supply chain, and spoiler alert: it’s not pretty.

Researchers from UC Santa Barbara decided to get their hands dirty by testing 428 paid and free LLM API routers. Think of these guys as the middlemen of the digital world-kind of like that friend who insists on being the designated driver but secretly drinks all your beer. They see everything: every message, tool call, and JSON payload in plain text. Yep, they’re the nosy neighbors of the internet.

And guess what? No provider is enforcing any sort of cryptographic integrity between you and the upstream model. So, you’re basically sending your secrets into a black hole, and we all know how that usually ends…

The Numbers Nobody Was Watching

Out of the 28 paid routers purchased from Taobao, Xianyu, and Shopify-hosted storefronts, just one was actively playing the role of villain by injecting malicious code. Among the 400 free routers pulled from public developer communities, eight were also up to no good. And two of those clever little devils deployed adaptive evasion triggers-because what’s a cybercrime without a little cat-and-mouse game?

In a shocking twist, 17 routers had a little backstage pass to researcher-owned AWS canary credentials, and one even drained ETH from a researcher-owned private key. That’s right, folks-this isn’t just theoretical; an actual wallet was emptied. Surprise!

What the Attacks Actually Do

The paper breaks down four attack classes that sound more like bad horror movie titles than anything else. Payload injection (AC-1) plants malicious instructions right inside your agent’s tool-calling flow. Secret exfiltration (AC-2) is when it quietly copies your credentials and sends them off to parts unknown. The adaptive variants? Oh, they take it up a notch. Dependency-targeted injection (AC-1.a) waits for a specific software package to pop up before launching its attack, while conditional delivery (AC-1.b) holds off until a behavioral trigger goes off. It’s like waiting for the perfect moment to drop the mic.

The researchers built a spiffy tool called Mine, a research proxy that runs all four attack classes against four public agent frameworks. They put it to the test with three client-side defenses: a fail-closed policy gate (because who doesn’t love a good fail-safe?), response-side anomaly screening, and append-only transparency logging. And guess what? These defenses are deployable now! No changes needed from the model providers-so why aren’t they in use yet?

A Leaked Key Generated 100 Million Tokens

The paper throws in two poisoning scenarios that make you go, “Wait, what?” In the first, a seemingly innocent router accessed a leaked OpenAI key and generated 100 million GPT-5.4 tokens, along with seven Codex sessions. In the second, a weakly configured decoy cranked out 2 billion billed tokens. That’s right, 99 separate credentials across 440 Codex sessions-and 401 sessions already running in what the paper calls autonomous YOLO mode. Yep, you heard that right. YOLO mode. Agents executing with zero human confirmation. What could possibly go wrong?

This connects to a larger pattern researchers have been tracking across autonomous AI agent deployments where agents with wallet access and tool-execution permissions become prime targets the moment a supply chain component goes rogue. So, a word of advice: keep your friends close, but your crypto wallets closer.

No Cryptographic Guarantees

The core vulnerability here is architectural. LLM agents route tool-calling requests through third-party API proxies, which means these proxies have full plaintext access to every in-flight payload. There’s no cryptographic binding to ensure what you send actually reaches the upstream model untouched. A malicious router can read it, modify it, copy it, and-drumroll, please-drain it.

So, dear developers, anyone building on third-party LLM routers should treat them like that sketchy guy who promises you a great deal but keeps looking over his shoulder. Until integrity verification becomes standard across the stack, consider them untrusted intermediaries. The defenses the researchers propose exist now. The attacks do too. Happy coding!

The study is authored by Hanzhi Liu, Chaofan Shou, Hongbo Wen, Yanju Chen, Ryan Jingyang Fang, and Yu Feng, and is available in full at arxiv.org/abs/2604.08407.

Read More

2026-04-14 06:39