As AI agents increasingly rely on third-party API routers, criminals are using this dependence to trick users and inject malicious code into their machines.
-
Malicious API routers can hijack AI agents to inject code and steal secrets.
-
Study finds compromised routers leaking credentials and even crypto assets.
-
Attackers exploit weak configurations and third-party dependencies at scale.
A new report from the University of California and private-sector cybersecurity researchers has shown that, across 28 paid routers purchased from Taobao, Xianyu, and Shopify-hosted storefronts and 400 free routers collected from public communities, 1 paid and 8 free routers were injecting malicious code.
Two were deploying adaptive evasion triggers, 17 were touching researcher-owned AWS canary credentials, and 1 stole ethereum (ETH) from a researcher's wallet after accessing their private key.
What's more, two poisoning studies also showed that even benign routers can be pulled into the same attack surface as they process end-user requests using leaked credentials and poorly configured peers.
Strong password generator
For example, intentionally leaked OpenAI keys and weakly configured decoys have processed billions of tokens from these routers, exposing credentials across hundreds of sessions and allowing direct payload injection.
"The March 2026 LiteLLM compromise demonstrated exactly this primitive at scale: once the attacker controlled the request pipeline, every transiting tool call was exposed to rewriting," the researchers said.
As reported by Cybernews, LiteLLM, a popular Python library used by AI developers, was compromised to deliver mass credential-harvesting malware.
Two main attack categories were also identified in the study: payload injection (rewriting the model's tool-call responses before the agent executes them) and secret exfiltration (copying credentials, API keys, and prompts that transit the router).
Criminals are using at least two evasion techniques to cover their tracks. For example, only specific package installs are being rewritten, or malicious behavior is activated only after a warm-up period.
The researchers say that client-side defenses, such as policy gates, anomaly screening, and transparency logs, can reduce exposure today. However, they concluded that to secure an agent ecosystem, it ultimately needs provider-backed response integrity.
Unlock more exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked