• A third-party LLM router sits on the trusted path. It can read and rewrite every request and response between your coding agent and the provider, and nothing verifies that the file edits the agent then makes match what the provider actually returned.
• The study injects at four escalating levels of subtlety: replace the response outright, append to it, have an LLM polish the injected text so it reads naturally, and polish it to match the provider's own output distribution.
• All four coding agents tested had a 0% defense success rate at every injection level. Client-side permission prompts do not help, because the poisoned instruction arrives wearing the model's own legitimate-looking answer.
• Whitelisting which commands may run and adding an LLM reviewer improve resistance but never restore end-to-end control. The authors argue the real fix is output-integrity guarantees from the provider, not more client-side checks.
• They released SIDEL, a framework that records agent traces, replays them, injects at any of the four levels, and scores defenses, along with a curated 400-sample dataset so the attack can be reproduced.

• AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
• LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.

Most agent stacks route through a router without accounting for what that layer costs or sees.

• videoThe 100-Tool Agent Is a Trap - Sohail Shaikh & Ankush Rastogi, ProsodicaAI Engineer
• articleAgentChaos: Chaos Engineering for Agent Systems via Programmatic Fault InjectionGou Tan, Zhensu Sun, Jieke Shi, Ting Zhang, Zilong He, Qingfu Wu, Shuai Liang, Weifeng Sun, Junda He, Pengfei Chen, Chuanfu Zhang, Lwin Khin Shar, David Lo
• articleFactory RouterFactory News

Checking sign-in…

Loading comments…