API Routers in Coding Agents Bypass Security Safeguards, Study Finds

When autonomous coding agents operate with high autonomy to reduce interaction overhead, they typically route requests through third-party API routers that sit between the agent and language model providers. A new empirical study reveals a critical vulnerability: these intermediaries can inspect and alter every request and response without detection, yet standard permission controls offer little protection.

The Security Gap#

Researchers examined what happens when a third-party router intentionally interferes with agent behavior. Since nothing verifies that the provider's output matches what the agent actually executes, malicious routers can modify repository-level actions while evading client-side safeguards designed to prevent such tampering. The study asked a fundamental question: can this control gap cause real harm in practice?

Testing Four Attack Levels#

The team developed SIDEL, a framework for recording, replaying, and testing attacks, and evaluated four increasingly sophisticated injection methods:

• Response Substitution (L1): Directly replace the router's output
• Response Append (L2): Add malicious code to legitimate responses
• LLM-Polished Injection (L3): Use language models to craft injections that mimic authentic output
• LLM-Polished with Distribution Alignment (L4): Fine-tune injections to match statistical patterns of real responses

Bleaker Results Than Expected#

Using a curated dataset of 400 samples, researchers tested four representative coding agents. The results were stark: without additional protections, all agents achieved a 0 percent defense success rate across all injection levels. Even when researchers added client-side mitigation strategies like whitelisted execution controls and LLM-based code review, the agents' resistance improved but did not fully restore end-to-end control.

Implications and Next Steps#

The work underscores that router-side tampering substantially changes what code actually gets written and deployed—and that existing defenses cannot reliably catch it. The authors argue that the industry needs stronger guarantees from upstream providers to cryptographically verify output integrity, rather than relying solely on client-side checks that third-party intermediaries can circumvent.