Chaofan Shou and the authors of “Your Agent Is Mine” claim third-party LLM routers inject malicious code and expose actionable credentials, with Shou reporting a newly purchased 6TB dataset, making router selection a direct host-compromise and secret-exposure risk for agent deployments.

What is this?

Why it matters to Scott

Measured heat

How the heat travelled

Evidence (5) — ⭐ canonical anchor

Chaofan Shou @shoucccc I bought a Fable dataset from one of the top Chinese LLM routers yesterday. 

With just 6TB data, I can take over 7 Chinese/CIS gov entities & 19 top Chinese firms like Xiaomi, Huawei, NIO, Minimax using SSH keys, VPN configs, Aliyun keys, GitLab tokens sent to the router. Chaofan Shou @shoucccc Apr 10 26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet.

We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts. 

Check our paper: arxiv.org/abs/2604.08407 10:00 PM · Sep 10, 2026 1.2M Views 135 424 4.5K 3K

Computer Science > Cryptography and Security arXiv:2604.08407 (cs) [Submitted on 9 Apr 2026] Title: Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain Authors: Hanzhi Liu , Chaofan Shou , Hongbo Wen , Yanju Chen , Ryan Jingyang Fang , Yu Feng View a PDF of the paper titled Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain, by Hanzhi Liu and 5 other authors View PDF HTML (experimental) Abstract: Large language model (LLM) agents increasingly rely on third-party API routers to dispatch tool-calling requests across multiple upstream providers. These routers operate as application-layer proxies with full plaintext access to every in-flight JSON payload, yet no provider enforces cryptographic integrity between client and upstream model. We present the first systematic study of this attack surface. We formalize a threat model for malicious LLM API routers and define two core attack classes, payload injection (AC-1) and secret exfiltration (AC-2), together with two adaptive evasion variants: dependency-targeted injection (AC-1.a) and conditional delivery (AC-1.b). Across 28 paid routers purchased from Taobao, Xianyu, and Shopify-hosted storefronts and 400 free routers collected from public communities, we find 1 paid and 8 free routers actively injecting malicious code, 2 deploying adaptive evasion triggers, 17 touching researcher-owned AWS canary credentials, and 1 draining ETH from a researcher-owned private key. Two poisoning studies further show that ostensibly benign routers can be pulled into the same attack surface: a leaked OpenAI key generates 100M GPT-5.4 tokens and more than seven Codex sessions, while weakly configured decoys yield 2B billed tokens, 99 credentials across 440 Codex sessions, and 401 sessions already running in autonomous YOLO mode. We build Mine, a research proxy that implements all four attack classes against four public agent frameworks, and use it to evaluate three deployable client-side defenses: a fail-closed policy gate, response-side anomaly screening, and append-only transparency logging. Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2604.08407 [cs.CR] (or arXiv:2604.08407v1 [cs.CR] for this version) https://doi.org/10.48550/arXiv.2604.08407 Focus to learn more arXiv-issued DOI via DataCite Submission history From: Yanju Chen [ view email ] [v1] Thu, 9 Apr 2026 16:06:41 UTC (54 KB) Full-text links: Access Paper: View a PDF of the paper titled Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain, by Hanzhi Liu and 5 other authors View PDF HTML (experimental) TeX Source view license Current browse context: cs.CR < prev | next > new | recent | 2026-04 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar export BibTeX citation Loading... BibTeX formatted citation × loading... Data provided by: Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ( What is the Explorer? ) Connected Papers Toggle Connected Papers ( What is Connected Papers? ) Litmaps Toggle Litmaps ( What is Litmaps? ) scite.ai Toggle scite Smart Citations ( What are Smart Citations? ) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ( What is alphaXiv? ) Links to Code Toggle CatalyzeX Code Finder for Papers ( What is CatalyzeX? ) DagsHub Toggle DagsHub ( What is DagsHub? ) GotitPub Toggle Gotit.pub ( What is GotitPub? ) Huggingface Toggle Hugging Face ( What is Huggingface? ) ScienceCast Toggle ScienceCast ( What is ScienceCast? ) Demos Demos Replicate Toggle Replicate ( What is Replicate? ) Spaces Toggle Hugging Face Spaces ( What is Spaces? ) Spaces Toggle TXYZ.AI ( What is TXYZ.AI? ) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower ( What are Influence Flowers? ) Core recommender toggle CORE Recommender ( What is CORE? ) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs . Which authors of this paper are endorsers? | Disable MathJax ( What is MathJax? )

Interpretation history

• 2026-09-14T03:31:07Z
  The CodexAPI.pro attachment adds a potentially independent allegation, but its truncated body contains no wire captures or setup-script evidence to assess; the investigation title does not establish corroboration. The router trust-boundary concern remains substantive, without new validation of credential exposure or host compromise.
• 2026-09-14T03:21:27Z
  evidence attached: reddit.post.1wfrwb6 — The reported wire-level investigation is a concrete, potentially independent example of model spoofing and dangerous behavior by an unofficial LLM-access service.
• 2026-09-11T11:29:26Z
  No new substantive evidence since last look — only routine comment refresh on the OpenRouter piece, no incident confirmation, no independent corroboration of the 6TB claim or named-victim takeover. Cooling heat given repetitive amplification and no forward motion.
• 2026-09-11T10:29:52Z
  The refreshed discussion adds generic concern about router trust and costs, not independent incident evidence or an OpenRouter-specific compromise. Cool the repetitive amplification while keeping the research-backed attack surface and the unverified 6TB credential-exposure allegation live.
• 2026-09-11T09:31:55Z
  The new OpenRouter-titled attachment provides no substantive article content, so it neither independently corroborates the research nor establishes an OpenRouter-specific incident. The previously alerted credential-exposure allegation remains worth near-term follow-up, with no new evidence of named-victim takeover or exposure of Scott’s infrastructure.
• 2026-09-11T09:22:23Z
  evidence attached: hn.story.49621546 — The technical article directly concerns the risks and tradeoffs of relying on an external LLM router, bearing on the open router-security hypothesis.
• 2026-09-11T07:30:09Z
  The retrieved arXiv abstract establishes the authorship and reported experimental scope beyond the cached secondary grounding, but the paper and Shou’s dataset allegation remain one research group’s evidence, not independent corroboration. The fresh credential-exposure allegation warrants follow-up; neither successful takeover of the named organisations nor exposure of Scott’s own infrastructure is established.
• 2026-09-11T07:26:27Z
  grounded: converges/high — The reported router-poisoning experiments converge with Scott’s Agent Provenance Stack and SiloOS separation of model output from authorised execution, and warr
• 2026-09-11T07:23:27Z
  case created — The primary paper and its author's fresh, unverified claim of extensive actionable credential exposure warrant prompt follow-up as one router-security episode, not independent corroboration of the newly alleged victims.

Decision trace

• 09-25 16:44review_dormantscheduled targets exhausted or 28 quiet days
• 09-25 16:44drop_targetsquiet through full ladder or over cap 8
• 09-20 18:26drop_targetsquiet through full ladder or over cap 8
• 09-15 14:25review_screenThe added Reddit comments reiterate unverified allegations about model spoofing, proxy behavior, and fabricated model configurations without supplying complete technical artifacts or independently val
• 09-14 13:31repriceThe CodexAPI.pro attachment adds a potentially independent allegation, but its truncated body contains no wire captures or setup-script evidence to assess; the investigation title does not establish c
• 09-14 13:21attachThe reported wire-level investigation is a concrete, potentially independent example of model spoofing and dangerous behavior by an unofficial LLM-access service.
• 09-14 13:21propose_attachThe reported wire-level investigation is a concrete, potentially independent example of model spoofing and dangerous behavior by an unofficial LLM-access service.
• 09-12 16:21review_screenThe added comments discuss previously noted provider inconsistency and reliability; the OpenRouter co-founder’s response is general and provides no new incident confirmation, credential exposure evide
• 09-11 21:29repriceNo new substantive evidence since last look — only routine comment refresh on the OpenRouter piece, no incident confirmation, no independent corroboration of the 6TB claim or named-victim takeover. Co
• 09-11 21:29alert_silentThis is a comment_update dirty trigger with no substantive new content; Scott already received the research findings and 6TB allegation in prior alerts. No named confirming fact is pending.
• 09-11 21:29alert_routeThis is a comment_update dirty trigger with no substantive new content; Scott already received the research findings and 6TB allegation in prior alerts. No named confirming fact is pending.
• 09-11 21:21sensor_dirtycomment_update
• 09-11 20:29repriceThe refreshed discussion adds generic concern about router trust and costs, not independent incident evidence or an OpenRouter-specific compromise. Cool the repetitive amplification while keeping the
• 09-11 20:29alert_silentScott already received the substantive security warning; these comments add no affected-provider identification, independent validation, mitigation, or Scott-specific exposure. Another interruption wo
• 09-11 20:29alert_routeScott already received the substantive security warning; these comments add no affected-provider identification, independent validation, mitigation, or Scott-specific exposure. Another interruption wo
• 09-11 20:21sensor_dirtycomment_update
• 09-11 19:31repriceThe new OpenRouter-titled attachment provides no substantive article content, so it neither independently corroborates the research nor establishes an OpenRouter-specific incident. The previously aler
• 09-11 19:31alert_silentScott already received the research findings and 6TB allegation together. The attachment adds no verified incident, affected-provider identification, mitigation or independent validation; another inte
• 09-11 19:31alert_routeScott already received the research findings and 6TB allegation together. The attachment adds no verified incident, affected-provider identification, mitigation or independent validation; another inte
• 09-11 19:22alert_silentThe new attachment supplies only a blog title and link, with no substantive claims, findings, affected configurations, or mitigations. It does not establish an OpenRouter-specific incident or change t
• 09-11 19:22alert_routeThe new attachment supplies only a blog title and link, with no substantive claims, findings, affected configurations, or mitigations. It does not establish an OpenRouter-specific incident or change t
• 09-11 19:22attachThe technical article directly concerns the risks and tradeoffs of relying on an external LLM router, bearing on the open router-security hypothesis.
• 09-11 19:22propose_attachThe technical article directly concerns the risks and tradeoffs of relying on an external LLM router, bearing on the open router-security hypothesis.
• 09-11 17:30repriceThe retrieved arXiv abstract establishes the authorship and reported experimental scope beyond the cached secondary grounding, but the paper and Shou’s dataset allegation remain one research group’s e
• 09-11 17:30alert_silentScott has already received a heads-up covering both the router experiments and the 6TB allegation. This reevaluation adds no new disclosure, independent validation, affected-provider identification or
• 09-11 17:30alert_routeScott has already received a heads-up covering both the router experiments and the 6TB allegation. This reevaluation adds no new disclosure, independent validation, affected-provider identification or
• 09-11 17:28pushpriced heat=high at create: Chaofan Shou and the authors of “Your Agent Is Mine” claim third-party LLM routers inject malicious code and expose actionable credentials, with Shou reporting a newly purc
• 09-11 17:28alert_routepriced heat=high at create: Chaofan Shou and the authors of “Your Agent Is Mine” claim third-party LLM routers inject malicious code and expose actionable credentials, with Shou reporting a newly purc
• 09-11 17:28alert_shadowThe supplied author-attributed paper summary reports a study of 28 paid and 400 free routers, including malicious code injection, access to researcher-owned canary credentials and an ETH drain from a
• 09-11 17:28alert_routeThe supplied author-attributed paper summary reports a study of 28 paid and 400 free routers, including malicious code injection, access to researcher-owned canary credentials and an ETH drain from a
• 09-11 17:26groundThe reported router-poisoning experiments converge with Scott’s Agent Provenance Stack and SiloOS separation of model output from authorised execution, and warrant reviewing Ask’s response-to-shell di
• 09-11 17:23createThe primary paper and its author's fresh, unverified claim of extensive actionable credential exposure warrant prompt follow-up as one router-security episode, not independent corroboration of th