这篇论文告诉你，用第三方API路由调用LLM时，你的代码可能被悄悄篡改。四种攻击方式，现有防御全失效，值得搞智能体开发的看看。
本文通过实证研究，分析了第三方API路由在编码智能体（coding agents）中的注入攻击风险。研究设计了四种逐渐隐蔽的干预级别：响应替换（L1）、响应追加（L2）、LLM润色注入（L3）和LLM润色+分布对齐注入（L4）。作者开发了SIDEL框架，包含400个样本的数据集，用于跟踪、重放、注入和防御评估。在四种代表性编码智能体上，所有注入级别下的防御成功率均为0%。现有客户端白名单执行控制和LLM审查无法完全检测拦截。论文呼吁提供商提供输出完整性保障。
Where Is the Cost of Third-Party API Routers in Agentic Software Development?
Third-party API routers have become a common layer that unifies access across increasingly diverse LLM providers. In coding-agent workflows, high-autonomy operation is widely adopted because it reduces interaction overhead. As a result, a third-party API router, which sits between the agent and the upstream provider, inevitably occupies the trusted path. It can inspect and modify every request and response, yet no mechanism verifies alignment between the provider's output and the repository-level actions ultimately executed by the agent. Consequently, client-side permission mechanisms may become ineffective in practice. Whether this control gap produces real, hard-to-detect effects on software development tasks remains empirically unmeasured. In this paper, we conduct an empirical study of router-side injection in coding agents, examining four intervention levels of increasing subtlety: Response Substitution (L1), Response Append (L2), LLM-Polished Injection (L3), and LLM-Polished with Distribution Alignment Injection (L4). Moreover, we develop SIDEL, a framework for trace recording, replay, injection, and defense evaluation, with a curated dataset of 400 samples. We evaluate four representative coding agents, and further evaluate whitelist-based execution control and LLM review. Router-side intervention substantially alters repository-level actions and remains difficult for existing client-side safeguards to detect. Without additional mitigations, all evaluated agents achieved a defense success rate of 0 percent across all injection levels. Client-side mitigations and reactive reviews improve resistance but do not fully restore end-to-end control, motivating provider-side output-integrity guarantees. Our code is available at https://github.com/Riyasushin/SIDE.