LLM routers secretly inject malicious tool calls
For developers, this matters because it shows how LLM routers can be hacked to steal credentials and redirect traffic, potentially costing thousands.
Chaofan Shou and others found that LLM routers can be compromised to steal credentials and inject malicious tool calls.
One incident drained a client's $500k wallet.They also managed to poison routers to redirect traffic.
Within hours, they could take over ~400 hosts.Check their paper: arxiv.
org/abs/2604.08407.
用中转站的要注意信息安全 Chaofan Shou @Fried_rice 26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet. We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts. Check our paper: arxiv.org/abs/2604.08407 🔗 View Quoted Tweet📊 5 ⚡
This report is categorized under AITOP's "Papers" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI regulation, compliance frameworks, and sovereign compute policy and AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include LLM routers, arxiv, security, malicious tool calls.
Source attribution: curated from 宝玉 (@dotey).