{"schema_version":"0.10.0","id":"LR-2026-0501","record_version":1,"title":"Malicious LLM API routers intercept agent tool calls and steal credentials and crypto (UC Santa Barbara study)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.9,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.2,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Cyber Security News · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: Cyber Security News · subject to change"}]},"sources_hash":"55e5c03833d9a154322f0719f4c929cff76f55308edf4907d3928788543feb8f"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-04-10","incident_class":"security_compromise","failure_class":"credential_misuse","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Researchers at the University of California, Santa Barbara studied third-party LLM API routers that sit between AI agent clients and model providers. They bought 28 paid routers and collected 400 free ones. Nine routers injected malicious code into returned tool calls. Seventeen free routers used intercepted researcher AWS credentials without authorization, and one drained ETH from a researcher-owned key. In a second study, weak decoy routers drew 40,000 unauthorized access attempts and exposed 99 credentials across 440 Codex sessions, 401 of them in autonomous YOLO mode. The paper was published on Thursday. The researchers recommend client-side defenses and provider-signed responses.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK06","secondary_risks":["RK03"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Minor: losses are confined to researcher-owned decoy keys in one experiment, and no third party is stated as affected.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cybersecuritynews.com/ai-router-vulnerabilities/","publisher":"CyberSecurityNews","date":"2026-04-10","type":"press","title":"AI Router Vulnerabilities Allow Attackers to Inject Malicious Code and Steal Sensitive Data - CyberSecurityNews","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.tradingview.com/news/cointelegraph:0bd106010094b:0-researchers-discover-malicious-ai-agent-routers-that-can-steal-crypto/","publisher":"TradingView","date":"2026-04-12","type":"press","title":"Researchers discover malicious AI agent routers that can steal crypto - TradingView","archived_url":null}],"per_field_confidence":{"event.incident_class":"C","event.agent_involved":"C","event.failure_class":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"A critical and largely overlooked attack surface in the AI agent ecosystem, third-party API routers that can be weaponized to silently hijack tool calls, drain cryptocurrency wallets, and exfiltrate sensitive credentials at scale."}],"event.agent_involved":[{"source_index":0,"quote":"As AI agents increasingly automate high-stakes tasks, executing code, managing cloud infrastructure, and handling financial transactions, they depend on intermediary services called LLM API routers to dispatch requests to providers like OpenAI, Anthropic, and Google."}],"event.failure_class":[{"source_index":0,"quote":"17 free routers triggered follow-on unauthorized use of researcher-owned AWS credentials after intercepting them in transit."}],"impact.severity":[{"source_index":1,"quote":"The researchers prefunded Ethereum wallet “decoy keys” with nominal balances and reported that the value lost in the experiment was below $50, but no further details such as the transaction hash were provided."}],"impact.severity_because":[{"source_index":1,"quote":"The researchers prefunded Ethereum wallet “decoy keys” with nominal balances and reported that the value lost in the experiment was below $50, but no further details such as the transaction hash were provided."}],"event.summary":[{"source_index":0,"quote":"LLM API routers sit between AI agent clients and upstream model providers, operating as application-layer proxies with full plaintext access to every in-flight JSON payload."},{"source_index":0,"quote":"The UC Santa Barbara team purchased 28 paid routers from platforms like Taobao, Xianyu, and Shopify-hosted storefronts, and collected 400 free routers from public communities."},{"source_index":0,"quote":"9 routers actively injected malicious code into returned tool calls (1 paid, 8 free)."},{"source_index":0,"quote":"17 free routers triggered follow-on unauthorized use of researcher-owned AWS credentials after intercepting them in transit."},{"source_index":0,"quote":"1 router drained ETH from a researcher-owned Ethereum private key."},{"source_index":0,"quote":"These attracted 40,000 unauthorized access attempts, served roughly 2 billion billed tokens, exposed 99 credentials across 440 Codex sessions spanning 398 different projects, and critically, 401 of those 440 sessions were already running in autonomous YOLO mode, where tool execution is auto-approved without per-command confirmation."},{"source_index":1,"quote":"A paper measuring malicious intermediary attacks on the LLM supply chain, published on Thursday by the researchers, revealed four attack vectors, including malicious code injection and extraction of credentials."},{"source_index":0,"quote":"Until major providers like OpenAI and Anthropic implement such response-integrity mechanisms, developers deploying AI agents via third-party routers should treat every intermediary as a potential adversary and implement layered client-side defenses accordingly."}]},"notes_on_gaps":"No occurrence, disclosure or detection date is stated in the sources; the 2026-04-10 and 2026-04-12 dates are article publication dates and were not used. The tested AI systems, models, developers and harnesses are not named. Adversary identity and responsible party are not stated; adversarial_actor and responsible_party were left out. Counts differ across sources: TradingView quotes a researcher tweet of 26 malicious routers, while the 9 and 17 counts come from CyberSecurityNews; the adaptive-evasion count is 2 routers in one source. The loss figure below $50 is reported only as an approximate statement and was not recorded as a number. Severity was judged minor on the test that losses were confined to researcher-owned decoy keys in one experiment; no third party is stated as affected. Trigger was not stated and was left out. Controls B1, C3, G1 and A4 are judged to bear on this incident from the quoted sentences; the proposed defences are recommendations, not changes made by any party. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: Cyber Security News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Nine routers injected malicious code into returned tool calls.","quote":"9 routers actively injected malicious code into returned tool calls (1 paid, 8 free).","source_index":0,"grade":"C"},{"step":"reached","text":"Seventeen free routers used intercepted researcher AWS credentials without authorization.","quote":"17 free routers triggered follow-on unauthorized use of researcher-owned AWS credentials after intercepting them in transit.","source_index":0,"grade":"C"},{"step":"caught","text":"The researchers reported that a malicious router was hard to detect.","quote":"The researchers said it was not easy to detect when a router was malicious.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cybersecuritynews.com/ai-router-vulnerabilities/","https://www.tradingview.com/news/cointelegraph:0bd106010094b:0-researchers-discover-malicious-ai-agent-routers-that-can-steal-crypto/"]},"analysis":{"sections":{"timeline":[{"text":"In a second poisoning study, the team deployed weak router decoys across 20 domains and 20 IP addresses.","quote":"In a second poisoning study, the team deployed intentionally weak router decoys across 20 domains and 20 IP addresses.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://cybersecuritynews.com/ai-router-vulnerabilities/","https://www.tradingview.com/news/cointelegraph:0bd106010094b:0-researchers-discover-malicious-ai-agent-routers-that-can-steal-crypto/"]}}