Intel / article

Where Is the Cost of Third-Party API Routers in Agentic Software Development?

Source: arxiv.org
Author: Donghao Fu, Jingxin Li, Xue Jiang, Yihong Dong
Date: Published Jul 30, 2026

Context

A service that routes a coding 's requests to model providers occupies a sensitive position: it can modify the responses the agent receives. Researchers tested that risk by deliberately changing router responses in a 400-sample involving four coding agents. The interventions changed actions taken in repositories, and the tested execution restrictions and model-based reviews improved resistance without fully restoring control. This establishes a risk in the evaluated adversarial setup, rather than evidence that ordinary routing services are conducting such attacks. It also explains why evaluating an agent's local permissions alone leaves the integrity of its upstream responses unexamined. Study abstract.

Key takeaways · AI-distilled

A third-party router sits on the trusted path. It can read and rewrite every request and response between your coding agent and the provider, and nothing verifies that the file edits the agent then makes match what the provider actually returned.
The study injects at four escalating levels of subtlety: replace the response outright, append to it, have an LLM polish the injected text so it reads naturally, and polish it to match the provider's own output distribution.
All four coding agents tested had a 0% defense success rate at every injection level. Client-side permission prompts do not help, because the poisoned instruction arrives wearing the model's own legitimate-looking answer.
Whitelisting which commands may run and adding an LLM reviewer improve resistance but never restore end-to-end control. The authors argue the real fix is output-integrity guarantees from the provider, not more client-side checks.
They released SIDEL, a framework that records agent traces, replays them, injects at any of the four levels, and scores defenses, along with a curated 400-sample dataset so the attack can be reproduced.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
eval — A repeatable test for AI quality — a set of tasks plus scoring — used the way software teams use test suites, because model output is too variable to judge by eyeballing.
LLM — A large language model — the neural network behind tools like Claude and ChatGPT, trained on huge amounts of text to predict what comes next.

Key quotes

“As a result, a third-party API router, which sits between the agent and the upstream provider, inevitably occupies the trusted path.”

“It can inspect and modify every request and response, yet no mechanism verifies alignment between the provider's output and the repository-level actions ultimately executed by the agent.”

“Without additional mitigations, all evaluated agents achieved a defense success rate of 0 percent across all injection levels.”

“Client-side mitigations and reactive reviews improve resistance but do not fully restore end-to-end control, motivating provider-side output-integrity guarantees.”

Read the source arxiv.org