Back Risky.Biz

Risky Bulletin: Malicious LLM proxy routers found in the wild

Risky.Biz • April 15, 2026

Researchers find malicious LLM proxy routers, a fake Ledger crypto-wallet on the Mac App Store stole $10 million dollars, a ransomware crew leaks data from 38 law firms, and Google cracks down on back button hijacking.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious LLM Proxy Routers Compromise AI Security A recent study identified 28 malicious LLM proxy routers that can modify AI service responses and access sensitive credentials. The research tested 28 paid routers and 400 free routers, revealing that nine injected harmful commands, two employed delay triggers, and 17 accessed AWS account canaries. One router was capable of emptying a private Ethereum wallet, indicating severe malicious intent. The compromised routers can relay commands across a company's AI infrastructure, posing a significant risk of malware, credential theft, and data exfiltration. The research team demonstrated the threat by leaking an OpenAI API key, leading to over 400 sessions into their proxy mesh. This incident highlights vulnerabilities in AI cost-control systems and the potential for widespread impact on organizations utilizing LLMs. The findings emphasize the need for heightened security measures in AI deployments. 2 sources 71

Extracted Entities

Risky Bulletin: Malicious LLM proxy routers found in the wild

The full story

Extracted Entities

Attack Types (2)

MITRE ATT&CK (2)

Platforms (1)