AI Risk Wire

Cases › security breach › LR-2026-0501

Malicious LLM API routers intercept agent tool calls and steal credentials and crypto (UC Santa Barbara study)

Preliminary Why: 1 report: Cyber Security News · subject to change · 1 independent report

Status: no action reported

Severity minor
Reported 10 Apr 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity minor: losses are confined to researcher-owned decoy keys in one experiment, and no third party is stated as affected.

Researchers at the University of California, Santa Barbara studied third-party LLM API routers that sit between AI agent clients and model providers. They bought 28 paid routers and collected 400 free ones. Nine routers injected malicious code into returned tool calls. Seventeen free routers used intercepted researcher AWS credentials without authorization, and one drained ETH from a researcher-owned key. In a second study, weak decoy routers drew 40,000 unauthorized access attempts and exposed 99 credentials across 440 Codex sessions, 401 of them in autonomous YOLO mode. The paper was published on Thursday. The researchers recommend client-side defenses and provider-signed responses.

What happened

1 · What went wrongNine routers injected malicious code into returned tool calls.
2 · What it reached or didSeventeen free routers used intercepted researcher AWS credentials without authorization.
3 · How it was caughtThe researchers reported that a malicious router was hard to detect.

What was done

No source states an action or fix.

Risks

Supply-chain compromise
Primary24 incidents
Rising: 4 vs 0.2 a week
Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Sandboxed code execution

Application

Signed and verified components · Vetting of plug-ins, skills and dependencies · AI bill of materials · Vulnerability scanning of AI components · Model provenance checks · Least-privilege access for the agent

Infrastructure / target

Secrets scanning

Similar incidents

Waymo robotaxi collision with child near elementary school, Santa Monica (January 2026)2026-01-29

All cases of this kind ›

Evidence

No source states: what the AI was doing, when it happened, when it was found, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 1 items from the primary sources

What happened, in order

Not dated in the sources:

  • In a second poisoning study, the team deployed weak router decoys across 20 domains and 20 IP addresses.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-04-10
D inferred by us from the described behaviour, reason shown
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK06
D inferred by us from the described behaviour, reason shown
secondary risks
RK03
D inferred by us from the described behaviour, reason shown

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Why this severity
losses are confined to researcher-owned decoy keys in one experiment, and no third party is stated as affected.
D inferred by us from the described behaviour, reason shown

Notes on gaps

Controls B1, C3, G1 and A4 are judged to bear on this incident from the quoted sentences; the proposed defences are recommendations, not changes made by any party.

LR-2026-0501 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON