Your Agent Is Mine: Malicious LLM API Routers as an Agent Supply-Chain Boundary

At the client-owned dispatcher, intersect subject and workload grants from the signed tool registry with the separately authenticated task’s requested scope, and enforce the resulting tool set, expiry and atomic action budget on every call. This can deny Bash or package-install tools that the task does not need. The published methods scope tool names; once a broad Bash tool is allowed, they do not validate its command, installer domain or package name. A separate argument policy and narrow tool design are required for those checks. The paper’s allowlist gate and its synthetic results are not an evaluation of this AIDEFEND method; its adaptive benchmark also demonstrated bypass through an allowed domain or a local stager.

Moving an agent to a third-party router can be as small as changing a base URL and API key. Treat those route policies as signed, reviewed, canaried security artifacts so teams cannot silently drift from approved providers into weak relay chains or untrusted compatibility endpoints.

The study found many command-injectable sessions, most already running in auto-approve mode. Sandboxed tool execution, constrained network egress, and low-secret workspaces do not authenticate the tool call, but they sharply reduce damage if a malicious router changes what executes.

Use a distinct workload identity and bounded credential for each approved router or provider connection, and have the receiving service verify its issuer, audience, expiry and permitted route. This limits reuse across independently enforced services and the lifetime of an exposed key. Audience checks, OAuth or mTLS require support at that service; shortening a copied bearer key’s lifetime does not stop its use at the original service while it remains valid. An authenticated malicious router can still read traffic and rewrite returned tool calls. This control establishes service identity, not upstream response integrity or data-access authorization.

Apply the exact-artifact Semgrep gate in guidance G002 only after the final executable payload has been reconstructed and its complete target manifest, supported language and locally validated blocking rules are pinned. Bind the verdict to those bytes and the execution request, and recheck them before launch; unsupported targets, missing scans or errors deny execution. The Python AST gate in G001 is not a Bash-command scanner. Semgrep coverage must be established for this client’s shell or script surface; the published gate supplies no universal malicious-package detector and cannot inspect a remote installer merely by scanning its download command. Allowed-domain payloads, unrecognized constructs and local stagers remain risks, so retain separate execution isolation and package policy.

Passive router exfiltration is dangerous because secrets and high-sensitivity values ride through ordinary request and tool-output fields. Tracking value provenance and blocking unsafe transfers into external HTTP, shell, package, or logging sinks directly targets the AC-2 data-flow problem. This requires a controlled runtime with authenticated source/content bindings for every derived value, complete sink coverage and fail-closed unknown labels. One ingress label does not track arbitrary model rewriting. Native processes, browser requests and allowed destinations need separately verified coverage; stock SaaS deployment is not established.

Consume the actual authorization and schema-validation outcomes from the client’s tool-enforcement layer. Verify signed decision receipts, their freshness, policy version and exact proposal/action binding, then append and independently reconcile every allowed and denied terminal decision. Alert on verified denial bursts and validation failures using environment-specific policy. This requires a trusted receipt verifier and protected event sink; agent-supplied labels or ordinary request logs do not establish the decision. The paper’s IsolationForest screener scores returned tool-call features and is a different method. This mapping monitors enforcement outcomes; it does not classify arbitrary commands, authorize tools or block execution.

Specialized agent and session logging answers, after suspicious activity, exactly which router, account, request, and tool call were exposed. Bind router URL, TLS metadata, request/response hashes, tool names, authenticated principal, and approval mode into append-only, privacy-preserving session records. This is especially important for AC-2, where traffic looks normal until a canary or stolen credential is used downstream.