On 9 April 2026, Hanzhi Liu, Yanju Chen, Chaofan Shou, Hongbo Wen, Ryan Jingyang Fang, and Yu Feng posted Your Agent Is Mine on arXiv. LLM agents, they write, send tool-calling traffic through third-party API routers that dispatch requests across upstream providers. Those routers are application-layer proxies. They see every in-flight JSON payload in plaintext. No provider, they write, enforces cryptographic integrity between the client and the upstream model.
They distinguish this from a classic network man-in-the-middle. Nobody has to break TLS or fake a certificate. The client sets the router's URL as the API endpoint on purpose. The router ends the client's HTTPS session, reads the JSON, then opens a new HTTPS session upstream. The paper calls this a router-in-the-middle.
There is no signature binding the model's tool call to the action the agent runs. A dishonest hop can rewrite a returned tool call or copy a secret. Honest routers further along the chain cannot see that rewrite.
They bought 28 paid routers from Taobao, Xianyu, and Shopify-hosted storefronts, and collected 400 free routers. One paid router and eight free ones, they write, were injecting into returned tool calls.
Two deployed adaptive evasion triggers. Seventeen touched at least one researcher-owned AWS canary credential. One drained ETH from a researcher-owned private key. Two poisoning studies: leaked OpenAI keys and weakly configured decoys processed 2.1 billion tokens from these routers, exposing 99 credentials across 440 Codex sessions, with 401 already auto-approving tools. They evaluate a fail-closed policy gate, response-side anomaly screening, and append-only transparency logging as client-side defenses. They argue that providers should sign the final tool-bearing envelope so a rewritten call cannot pass as the model's.
On 10 April 2026, Shou posted. Twenty-six LLM routers, he wrote, are secretly injecting malicious tool calls and stealing credentials. One drained our client $500k wallet. We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over about 400 hosts. He linked the paper.
On 10 September 2026 he posted again. I bought a Fable dataset from one of the top Chinese LLM routers yesterday, he wrote. With just 6 TB of data, I can take over 7 Chinese/CIS gov entities and 19 top Chinese firms like Xiaomi, Huawei, NIO, Minimax using SSH keys, VPN configs, Aliyun keys, GitLab tokens sent to the router.
