Router-side injection beat every coding agent tested

A compromised router beat every coding agent tested, posting a 0% defense rate across four escalating injection levels, per arXiv 2607.23624.

Third-party routers like OpenRouter sit on the trusted path between an agent and its model. Nothing on that path verifies the response reaching the agent matches what the provider sent, and the agent executes on it anyway.

The researchers built SIDEL, a trace record-replay-inject framework. They tested it against four coding agents, using a 400-sample dataset across four escalating injection levels.

Two mitigations, whitelist-based execution control and LLM-based review, cut into how much damage got done, but the defense success rate held at 0%. Neither restored end-to-end control once the router had tampered with the response.

I've recommended routing through gateways like OpenRouter. This paper is the bill for that advice landing in my own feed.

What I'd want to see next is router-side attestation, something that proves the response reaching the agent is the one the provider actually sent. The framework's code is posted under Riyasushin's SIDE repo on GitHub.