2.1% of LLM API Routers Are Actively Malicious: What You Need to Know
If you’ve ever routed your AI agent’s calls through a third-party API proxy, you might want to pay close attention. Recent research found that 2.1% of LLM API routers are actively malicious — some even drained real cryptocurrency wallets. Let’s dig into what this means, how it happens, and what you can do to protect yourself.
Key Takeaways
- Around 2.1% of third-party LLM API routers are malicious, snooping on data and even stealing assets.
- These routers sit in plaintext between you and the AI provider, seeing all tokens, credentials, and API keys.
- Sophisticated malicious routers use evasion tactics, activating only after certain conditions to avoid detection.
- Enterprise platforms usually avoid this risk by routing directly; third-party proxies are mostly in informal markets.
- You should implement client-side safeguards like strict schema validation and thorough logging.
What Are LLM API Routers and Why Should You Care?
LLM API routers are third-party intermediaries developers use to connect their AI agents to multiple providers—often to save money. Instead of calling OpenAI or Anthropic’s API directly, an agent routes requests through a proxy, which then forwards them to the actual AI model. Sounds convenient, right? But there’s a catch.
Because these routers sit between your app and the AI provider, they can see all the data in transit—every prompt, your API key, any credentials included in requests.
And here’s the kicker: Most router-to-provider communications aren’t cryptographically protected to ensure integrity, meaning the router can tamper with or even steal your data.
Malicious Routers: A Hidden Threat
A recent audit of 428 LLM API routers uncovered that 9 were actively malicious. That’s roughly 2.1%. Actions included:
- Draining an Ethereum wallet controlled by a researcher.
- Harvesting credentials from AWS accounts and other services.
- Running hidden payloads that activate only after multiple benign requests to stay under the radar.
One particularly sneaky detail was that some malicious routers were designed to evade casual tests. For example, they’d behave normally for the first 50 requests before switching to malicious behavior or triggered only when specific AI packages like OpenAI or Anthropic appeared in the code.
The Bigger Picture: Where Are These Routers Used?
This threat mostly exists in informal or grey markets — places like Taobao/Xianyu storefronts, community Telegram bot services, or so-called “cheaper OpenAI” solutions that route your data through unknown intermediaries.
In contrast, big enterprise AI platforms like AWS Bedrock or Azure AI typically route requests directly from your environment to the provider, cutting out the risky third-party layer.
Real-World Example: When Convenience Came at a Cost
Imagine a startup that wanted to reduce API costs while developing an AI assistant. They plugged into a popular community-maintained router service, trusting it to forward requests seamlessly. Unknown to them, this router was harvesting API keys and wallet credentials from tokenized prompts.
Months later, they noticed strange charges on their cloud accounts and a missing chunk of ETH from their company wallet. The culprit? The very API router they’d relied on for cost savings. This real example shows how a convenience can quickly turn into a costly security gap.
What This Means For You
If you route your AI requests through a third-party router, understand the risks:
- Your data isn’t private—routers see everything unencrypted.
- You could lose money or leak sensitive credentials.
- Malicious routers can hide in plain sight for months.
So what can you do?
- Prefer direct connections to AI providers whenever possible.
- If you must use a router, enforce fail-closed policy gates that validate the router’s responses against expected schemas before your agent acts on them.
- Keep append-only logs for all tool-call payloads to audit suspicious activity.
- Stay wary of cheap, community-sourced API proxies.
Final Thoughts
The news that 2.1% of LLM API routers are actively malicious is a wake-up call for anyone building AI-powered services. While these routers might save cost or add flexibility, the security risks are real—and costly.
If you’re experimenting with third-party routing, do your homework. Make sure you understand the trade-offs and have protections in place.
What’s your take on this? Have you ever used third-party AI API routers? Drop a comment below and let’s chat about staying safe in this fast-evolving AI landscape.
You might also enjoy: Read more on Funion
