Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain · HackerPapers discussions

Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain — HN submission

Fri, 11 Sep 2026 06:50:08 GMT

Measuring Malicious Intermediary Attacks on the LLM Supply Chain

2 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain — mentioned by veganmosfet

Sun, 16 Aug 2026 16:22:09 GMT

The reseller could use an intermediate proxy and modify the traffic like in [1], to get control of the client machine - depending on the harness permissions. TLS terminates at the proxy (say, https://reselltokens.ai), end to end integrity is not enforced. LLM traffic contains tool calls like "bash ...", which are executed on the client machine, they can be manipulated. Secret exfil is also possible. [1] https://arxiv.org/html/2604.08407v1

Paper and discussion history. A mention is not an endorsement.

Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain — HN submission

Sat, 11 Apr 2026 17:17:01 GMT

Measuring Malicious Intermediary Attacks on the LLM Supply Chain

2 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain — HN submission

Fri, 10 Apr 2026 13:14:54 GMT

Your Agent Is Mine: Measuring Malicious Attacks on the LLM Supply Chain

4 points; 0 discussion replies on HN. Paper and source history. A submission is not an endorsement.

Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain — mentioned by trackoor001

Fri, 10 Apr 2026 04:03:30 GMT

https://arxiv.org/abs/2604.08407

Paper and discussion history. A mention is not an endorsement.

Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain — mentioned by trackoor001

Fri, 10 Apr 2026 02:45:17 GMT

26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet. We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts. Check our paper: https://arxiv.org/abs/2604.08407

Paper and discussion history. A mention is not an endorsement.