On: LLM routers are injecting malicious tool calls and stealing creds

26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet.

We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts.

Check our paper: https://arxiv.org/abs/2604.08407