Command integrity breaks in the LLM routing layer

This research report documents critical risks in intermediary LLM routers: some paid and free routers have been observed injecting malicious code into tool calls, capturing plaintext credentials (API keys, AWS canaries, Ethereum keys), and enabling unauthorized command execution. Experiments and a March 2026 LiteLLM incident show targeted/delayed manipulations, large-scale credential reuse and exfiltration, and incorporation of weak relays into active routing paths, highlighting a supply-chain style threat to agent systems and the need for stronger client-side controls and end-to-end verification.