Research: 26 LLM routers are secretly injecting malicious tool calls and stealing credentials

MeNews · 2026-04-10T05:23:18+00:00

Solayer team member Chaofan Shou posted on the X platform, stating that 26 LLM routers are secretly injecting malicious tools to steal credentials, with one causing a loss of $500k for a customer. Researchers successfully carried out a "pollution" attack on the routers, taking over approximately 400 hosts, revealing security threats of third-party LLM API routers.

MeNews

2026-04-10 05:23:18

Abstract generation in progress

ME News Report, April 10 (UTC+8), Solayer team member Chaofan Shou posted on X platform stating that 26 LLM routers are secretly injecting malicious tool calls and stealing credentials, with one router causing its customer to lose a $500k wallet. Researchers also successfully carried out a “pollution” attack on the routers, causing them to forward traffic to themselves, directly taking over about 400 hosts within hours. This is consistent with the conclusions of a research paper previously published by the team, revealing a significant security threat posed by third-party LLM API routers to proxy systems. (Source: PANews)

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

2 Likes