Large language model (LLM) API routers expose a critical security gap: because the router terminates the client's transport-layer security session and opens a separate upstream session, it holds the full interaction in plaintext. This makes the router an application-layer man-in-the-middle capable of rewriting agent tool calls, swapping dependencies for typosquatted packages, triggering attacks only under audit-evading conditions, and passively exfiltrating secrets. Existing client-side defenses are evadable, according to researchers from multiple institutions in a paper posted on arXiv.
The Threat Landscape
The researchers identify four distinct malicious-router attack classes that succeed against a plaintext-access baseline:
- Rewriting agent tool calls to alter the intended action
- Swapping dependencies for typosquatted packages to inject malicious code
- Triggering attacks under audit-evading conditions to avoid detection
- Passively exfiltrating secrets such as API keys or sensitive data
These attacks are possible because the router sees all plaintext data between the client and the LLM.
How AEGIS Works
The paper proposes AEGIS, a provider-transparent attested API router whose data path is a client-verified faithful passthrough. AEGIS confines plaintext handling to a small hardware-enclave component, while authentication, scheduling, accounting, and management remain on the untrusted host. The client verifies the enclave before releasing plaintext. The host can neither read nor alter the interaction, and plaintext leaves only toward destinations fixed by the measured image.
AEGIS carries three provider-native APIs without conversion and completes every request under real-provider workload and concurrency.
Technical Specifications
The trusted path consists of 851 lines of code, minimizing the attack surface. The local relay overhead is about six milliseconds per request, making the security guarantee practical for latency-sensitive applications.
Security Validation
In a seeded audit pilot, two commodity coding agents were tasked with finding planted invariant violations. Agent 1 found 8 of 10 violations; Agent 2 found all 10. The paper states that all four malicious-router attack classes are blocked by AEGIS, including adaptive tests against the same boundary.
| Attack Class | Success Against Baseline | Blocked by AEGIS |
|---|---|---|
| Rewriting agent tool calls | Yes | Yes |
| Swapping dependencies for typosquatted packages | Yes | Yes |
| Triggering attacks under audit-evading conditions | Yes | Yes |
| Passively exfiltrating secrets | Yes | Yes |
Implications for Enterprise
For enterprises deploying LLM agents through API routers, AEGIS offers a provider-transparent hardening that does not require changes to existing cloud LLM services. The attestation mechanism gives clients cryptographic proof that their interaction is not being read or modified by the router host. With a small trusted computing base and low latency overhead, the approach addresses a previously unsealed attack surface in LLM infrastructure.
