LLM Routers Can Rewrite Tool Calls After Safety Checks, Enabling Code Execution

Jul 30, 2026 · Original article ↗

Summary

An LLM router that terminates TLS can read and rewrite tool-call responses before an agent receives them. The article says this can bypass model-side safeguards and enable code execution, while unsigned responses leave clients unable to verify changes.

Key points

A configured LLM router can access plaintext requests and responses, including tool arguments and credentials, and may rewrite a response before the client acts on it.
The described attack changes selected tool-call arguments while preserving the tool name and schema; a modified shell command could download and run attacker-controlled code.
Because rewriting occurs after inference, model alignment and input-side guardrails may work as intended yet fail to prevent the altered action.
The article describes dependency-name substitution that can evade domain-based allowlists, and conditional delivery that activates only under selected session conditions.
The article says provider responses lack cryptographic integrity binding them to what the client receives, preventing the client from checking whether a tool call was changed.
In a chain of resellers or aggregators, any intermediary that terminates TLS could modify or passively inspect traffic; downstream routers lack the original response needed to detect tampering.

Article Details

Attack Vectors: A malicious LLM router can modify tool-call arguments after the model generates its response, potentially causing an agent to execute attacker-selected commands.
An intermediary that terminates and re-originates TLS can read or alter plaintext responses; chained routers create multiple points where responses may be tampered with.
A router can rewrite a package name in an install command while leaving the command pointed at a legitimate package registry.
A router can conditionally activate modifications based on session characteristics, or passively observe and exfiltrate secrets carried in agent traffic.

MITRE ATT&CK

T1565.002 · Transmitted Data ManipulationThe article describes an intermediary rewriting tool-call arguments in transit before the client receives and executes them.

Vendors

AnthropicOpenAI returns tool calls with JSON-encoded arguments and Anthropic returns tool use blocks. Gemini exposes a similar structured interface. In every format, it’s essentially just plain JSON, nothing binding the response OpenAIOpenAI returns tool calls with JSON-encoded arguments and Anthropic returns tool use blocks. Gemini exposes a similar structured interface. In every format, it’s essentially just plain JSON, nothing binding the response

Products

GeminiOpenAI returns tool calls with JSON-encoded arguments and Anthropic returns tool use blocks. Gemini exposes a similar structured interface. In every format, it’s essentially just plain JSON, nothing binding the response Llama GuardThis is quite clever because model-side defenses are aimed at the wrong stage. Input classifiers, Llama Guard, NeMo Guardrails, instruction hierarchy training. All of these address instruction-bound failures where the NeMo Guardrailsclever because model-side defenses are aimed at the wrong stage. Input classifiers, Llama Guard, NeMo Guardrails, instruction hierarchy training. All of these address instruction-bound failures where the untrusted OpenRouterWe have routers which compose. For example, we have a developer that buys API access from a reseller who aggregates keys from a second-tier aggregator who routes through OpenRouter, which dispatches to the model host.