Researchers have identified a new cybersecurity risk in the AI ecosystem, warning that some third-party large language model (LLM) routers may be capable of stealing crypto assets and sensitive user data.

A recent study by researchers from the University of California found that certain intermediary services used to route AI requests can inject malicious code, extract credentials and compromise user security. These routers act as gateways between users and major AI providers such as OpenAI, Anthropic and Google.

“26 LLM routers are secretly injecting malicious tool calls and stealing credentials,” said co-author Chaofan Shou, highlighting the scale of the issue.

HOW AI ROUTERS CREATE SECURITY RISKS

LLM routers are increasingly used by developers to access multiple AI models through a single interface. However, these systems often terminate Transport Layer Security (TLS) connections, meaning they can access data in plaintext.

This creates a significant risk for developers using AI tools for sensitive tasks such as coding crypto wallets or smart contracts. Private keys, seed phrases and API credentials may be exposed to these intermediary systems without proper safeguards.

The findings point to a growing concern as AI agents become more integrated into blockchain development and financial applications.

Multi-hop LLM router supply chain. Source: arXiv.org

TESTS REVEAL ACTIVE EXPLOITS AND CRYPTO THEFT

The research team tested 28 paid routers and around 400 free routers sourced from public communities.

The results showed multiple active threats:

  • Nine routers were found injecting malicious code
  • Two used adaptive evasion techniques to avoid detection
  • Seventeen accessed researcher-controlled AWS credentials
  • One successfully drained Ether from a test wallet

To measure the impact, researchers used “decoy wallets” funded with small amounts of crypto. While the total loss was under $50, the experiment demonstrated that real-world theft is technically possible.

The team also conducted “poisoning studies,” showing that even previously safe routers can become compromised if they reuse leaked credentials through insecure systems.

DETECTION REMAINS A MAJOR CHALLENGE

One of the most concerning aspects of the study is how difficult it is to identify malicious routers.

Because routers already process sensitive data as part of normal operations, distinguishing between legitimate credential handling and theft is nearly impossible from the user’s perspective.

The researchers also flagged a feature known as “YOLO mode,” where AI agents automatically execute commands without user approval. This can increase the risk of unauthorized actions if the system is compromised.

Additionally, some routers may be unknowingly weaponized over time, while others may intentionally offer low-cost access to attract users before exploiting their data.

SECURITY RECOMMENDATIONS FOR DEVELOPERS

The researchers urged developers to take extra precautions when using AI tools in crypto-related environments.

They recommend avoiding the transmission of private keys, seed phrases or sensitive credentials through AI agent workflows. Strengthening client-side protections and carefully vetting third-party infrastructure are also critical steps.

As a long-term solution, the study suggests that AI providers implement cryptographic verification systems. This would allow users to confirm that responses and instructions originate directly from trusted models and have not been altered in transit.