당신의 에이전트는 내 것: LLM API 라우터의 보안 위험과 공급망 위협

이 요약은 AI가 원문을 분석해 생성했습니다. 정확한 내용은 원문 기준으로 확인하세요.

TL;DR

The "Your Agent Is Mine" paper reveals that third-party LLM API routers can intercept traffic, inject malicious code, and steal credentials, prompting a discussion on supply chain security.

배경

The author shares findings from the "Your Agent Is Mine" paper regarding security vulnerabilities in third-party LLM API routers and asks the community for mitigation strategies against supply chain risks.

의미 / 영향

This discussion highlights that relying on third-party API routers introduces critical supply chain vulnerabilities that cannot be ignored. Community consensus points toward the need for end-to-end encryption and rigorous verification of API intermediaries to prevent credential theft and malicious code injection.

섹션별 상세

The paper "Your Agent Is Mine" (arXiv 2604.08407) highlights significant security vulnerabilities in third-party LLM API routers. It details how these routers can act as man-in-the-middle attackers to compromise agent security. Researchers analyzed hundreds of routers from various platforms to quantify these risks. This study underscores the critical need for verifying the integrity of API intermediaries in agentic workflows.

Malicious routers exploit the lack of end-to-end integrity by terminating TLS connections. They inspect every byte of the request and originate a separate upstream connection, allowing them to rewrite tool calls or harvest API keys. The paper reports that 9 routers actively injected malicious code, while 17 accessed AWS canary credentials. This demonstrates that intermediaries can silently manipulate agent behavior and steal sensitive data.

Attacks are often adaptive, remaining dormant until certain conditions are met. Routers may wait for a specific number of calls or trigger only when the agent is in autonomous "YOLO mode". This stealthy approach makes detection difficult for standard monitoring tools. Security strategies must account for these delayed, context-aware threats in agentic workflows.

언급된 리소스

논문Your Agent Is Mine