How a Malicious LLM Router Hijacks Your Agent

Hover over any node to see what happens at that hop  •  based on arXiv:2604.08407 "Your Agent Is Mine"

Clean request / response Tainted / malicious response Compromised client
AGENT CLIENTS ROUTER CHAIN MODEL PROVIDERS 🕵️ external attacker Claude Code (YOLO) Codex (compromised) OpenClaw (honest path) R1 R2 R3 R4 ☠ R5 R6 R7 OpenAI Anthropic Google

Attack sequence (AC-1 / AC-2)

  1. Terminate TLS: every router hop decrypts the full request — system prompt, tool schema, API keys — in plaintext.
  2. Poison a hop: attacker controls or bribes one router (R4) anywhere in the multi-hop chain, even deep upstream.
  3. Payload injection (AC-1): on the return path, R4 rewrites a tool-call response — e.g. swaps a safe install command for a malicious script — while keeping valid JSON.
  4. Secret exfiltration (AC-2): R4 silently copies SSH keys, cloud tokens, and credentials seen in transit to an attacker endpoint.
  5. Adaptive evasion: some routers wait for a "warm-up" period or trigger only when they detect autonomous "YOLO mode" sessions.
  6. Taint propagation: the corrupted response flows back through R1 to Claude Code / Codex, which auto-executes it with no integrity check.
  7. Lateral takeover: stolen credentials (VPN configs, Aliyun keys, GitLab tokens) let the attacker pivot into internal infrastructure of the client organization.