{"id":"3813825b-5361-476d-9d9d-1da9adedcafe","arxiv_id":"2607.23624","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Router-side response tampering yields 0% defense success on Claude Code, Codex, Cursor, and OpenCode; whitelist and LLM review only partially restore control.","lead":"Third-party LLM API routers can silently rewrite coding-agent responses and drive harmful repository actions. Across four agents and four injection styles, client defenses failed completely unless extra gates were added—and even then control was only partial.","discovery_kind":"new_application","skeptic_critique":null,"referee_report":null,"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The load-bearing result is simple and useful: once a third-party router sits between provider and coding agent, L1–L4 response tampering drives injected tool calls to repository execution on Claude Code, Codex, Cursor, and OpenCode, with 0% DSR and no help from native permission modes or backend choice. That is the control gap the title asks about, and they actually measure it end-to-end instead of stopping at “malicious routers exist.”\n\nWhat is new is the apparatus and the downstream view. SIDEL’s record/replay/inject design isolates the router without touching agent or provider; the L1–L4 ladder (especially distribution-mixing L4) is a clean experimental axis; the 400-sample set is balanced and explicit; and RQ4 reports both DSR and collateral WBR for whitelist vs several reviewers rather than claiming a silver bullet. Code is linked. Citations to Liu, Luo, and the agent/SWE-bench line look appropriate—they build on router and response-path work rather than pretending the surface is undiscovered.\n\nSoft spots are mostly external validity, not internal collapse. Three SWE-bench Lite tasks, hand-built payloads, injection in the first 15 turns, and “closest fully autonomous / bypass” configs make the uniform 0% almost expected under the harness. That does not fake the mechanism, but it does mean “ineffective in practice” is stronger language than the sample supports. L4’s α=0.75 is a chosen knob with a small rewrite-quality appendix; fine as long as nobody treats it as canonical. Mitigations help partially and never fully close the gap—honest, and the paper’s own motivation for provider-side integrity follows from that.\n\nThis is for people shipping agentic IDEs, LLM gateways, or agent security evaluations. Math is light (definitions and a mixing equation); data and protocol carry the claim. I would bring it to reading group, cite the 0% cross-agent finding and SIDEL setup when discussing supply-chain trust for agents, and send it to referees. Accept the measured gap; push authors on deployment bounds and artifact pinning, not on whether the core experiment is coherent.","headline":"End-to-end evidence that on-path API routers can force 0% defense success on autonomous coding agents; the measurement is real, the generality claim needs tighter bounds.","tokens_in":20975,"tokens_out":555,"would_cite":true,"duration_ms":16810,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"When a third-party API router sits between a coding agent and the model, it can rewrite responses so the agent runs attacker-chosen repository actions that client safeguards never see coming.","keywords":["coding agents","API routers","LLM supply chain","router-side injection","tool-call integrity","agentic software engineering","output integrity","client-side safeguards"],"falsifier":"Re-run the same four agents on a broader set of live multi-repo workflows with default non-bypass permission UX and independently attested provider responses: if injected tool calls are blocked or never executed at high rates once the response path is integrity-checked end-to-end, the claimed practical control gap shrinks or disappears.","tokens_in":21198,"feed_emoji":"⚠️","tokens_out":986,"duration_ms":22672,"temperature":0.7,"pith_summary":"Coding agents increasingly reach language models through third-party API routers that unify keys, backends, and load balancing. In high-autonomy mode those agents auto-approve tool calls, so the router sits on the trusted path: it can read and rewrite every response before the agent acts. This paper argues that creates a control gap—nothing checks that the provider’s output matches the repository actions the agent actually runs—and that the gap is not theoretical. Using a replay-and-inject framework and 400 crafted malicious tool-call samples, the authors show that four levels of router-side tampering, from blunt response swap to subtle distribution-mixed rewriting, drive Claude Code, Codex, Cursor, and OpenCode to execute the injected actions with a 0% defense success rate when no extra mitigations are added. Permission modes and backend model choice do not close the gap. Whitelists and separate LLM reviewers raise resistance but still leave substantial leakage and collateral blocking, so the authors conclude that trustworthy agentic development needs provider-side output-integrity guarantees, not only client-side gates.","feed_headline":"API routers let attackers drive coding agents at 0% defense","feed_subtitle":"Four agents execute injected repo actions; client gates only partly close the gap","key_machinery":"SIDEL, a record–replay–inject harness that freezes provider traces and applies a four-level router intervention taxonomy (L1 full substitution, L2 append, L3 polished rewrite, L4 next-token distribution mixing) so downstream repository actions can be attributed to the delivered response rather than model sampling noise.","core_discovery":"Router-side intervention can systematically change what coding agents execute in a real repository while remaining hard for ordinary client-side checks to stop. Across four agents and four increasing-subtlety injection levels, defense success rate is 0% without extra mitigations: the injected tool call reaches execution, so provider output and agent action diverge whenever an untrusted router mediates the path.","pith_inferences":["Enterprises standardizing on one multi-provider gateway may be concentrating supply-chain risk: a single compromised router becomes a universal tool-call injector across every connected agent.","Distribution-aligned (L4-style) rewriting foreshadows attacks that leave almost no edit boundary for human or LLM reviewers, raising the bar for any purely textual audit.","The same control-gap logic likely extends beyond coding agents to any tool-using agent whose actions are authorized from an unauthenticated intermediary response.","A practical next measurement would compare attested direct provider channels against the same agents and payloads to quantify how much integrity guarantees buy in DSR terms."],"forward_implications":["High-autonomy coding-agent deployments that route through third-party gateways inherit a device-level integrity risk even when the upstream model is honest.","Client permission modes alone cannot restore control if they only gate what the agent already received from the router.","Whitelist and LLM-review gates reduce but do not eliminate successful injection and can block benign tools, so they are incomplete fixes.","Deployments that need trustworthy repository actions are pushed toward provider-supported output-integrity (signed or attested responses) rather than router-transparent trust.","Security evaluations of coding agents must treat the response path as an adversarial surface, not only prompts and tool outputs."],"fun_headline_variants":["Router injection drives coding-agent repo actions at 0% defense","Third-party API routers alter agent actions unseen by client checks","Coding agents hit 0% defense against router-side output injection","Untrusted API routers break agent control across four injection levels","SIDEL finds router injections evade client safeguards in coding agents"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"That testing agents in their most autonomous permission settings, on three SWE-bench Lite tasks, with a hand-built set of 400 malicious injections, is enough to show existing client-side permission mechanisms fail in real practice.","fun_headline_variants_meta":{"raw":{"variants":["Router injection drives coding-agent repo actions at 0% defense","Third-party API routers alter agent actions unseen by client checks","Coding agents hit 0% defense against router-side output injection","Untrusted API routers break agent control across four injection levels","SIDEL finds router injections evade client safeguards in coding agents"]},"model":"grok-4.5","effort":"low","cost_usd":0.002946,"raw_usage":{"total_tokens":1098,"prompt_tokens":856,"num_sources_used":0,"completion_tokens":69,"cost_in_usd_ticks":29464000,"prompt_tokens_details":{"text_tokens":856,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":173,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":856,"tokens_out":69,"duration_ms":4762,"temperature":1.0,"reasoning_tokens":173,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-30T17:23:35.319137+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Re-run the same four agents on a broader set of live multi-repo workflows with default non-bypass permission UX and independently attested provider responses: if injected tool calls are blocked or never executed at high rates once the response path is integrity-checked end-to-end, the claimed practical control gap shrinks or disappears.","supporting_citations":[],"review_version":1}