Coding Agents Have a Zero-Percent Defense Rate Against Router Injection

The standard mental model for securing agentic coding workflows puts the control boundary at the client: permission scopes, execution whitelists, LLM-based review layers. That boundary is in the wrong place. A third-party API router sits between the agent and the upstream model provider, touching every request and every response, and nothing in the current architecture verifies that what the router forwards matches what the provider actually returned.

This is not a theoretical gap. It is a structural one, and it has been empirically unmeasured until now.

The study introduces four intervention levels of increasing subtlety. Level 1 (Response Substitution) replaces the model's output wholesale. Level 2 (Response Append) inserts malicious instructions into an otherwise legitimate response. Level 3 (LLM-Polished Injection) rewrites the payload to match natural language style, making it harder to flag as anomalous. Level 4 (LLM-Polished with Distribution Alignment) additionally calibrates the injected content to match the statistical fingerprint of the target agent's normal output distribution, defeating detectors that rely on perplexity or token-probability signals. The key design insight: each level is not just more aggressive, it is designed to defeat the specific detection mechanism that would have caught the previous level. Think of it as a layered bypass, not a brute-force escalation.

To measure this systematically, the researchers built SIDEL, a framework for trace recording, replay, injection, and defense evaluation, with a curated dataset of 400 samples across four representative coding agents. SIDEL lets you replay a recorded agent session with injected router responses substituted in, then measure what repository-level actions actually execute. That replay capability is the methodological contribution that makes the results legible: you can isolate the router's effect from every other variable in the pipeline.

Without any additional mitigations, all four evaluated agents achieved a defense success rate of 0% across all four injection levels. That number does not improve because the agents are poorly designed. It is 0% because no current coding agent architecture includes a mechanism to verify output integrity between the router and the execution layer. Whitelist-based execution control and LLM-based review both improve resistance at the margins, but neither restores end-to-end control. The attack surface is at a layer those defenses were never designed to reach. For security engineers and platform teams shipping agentic coding tools, the takeaway is direct: client-side controls are not a substitute for provider-side output-integrity guarantees, and right now, those guarantees do not exist.

We're thinking: We find the 0% figure clarifying rather than alarming, because it names the real problem precisely. When a coding agent runs autonomously for hours, every token passes through the router unmonitored, and the agent's high-autonomy mode, the feature that makes it useful, is exactly what eliminates the human checkpoints that might otherwise catch anomalous behavior. The paper does not just map the attack surface; it exposes a category error in how the industry has been thinking about agentic security. Sandboxing execution and scoping permissions are necessary, but they address what the agent is allowed to do, not whether the instructions driving it have been tampered with. Until router-layer output integrity becomes a first-class infrastructure concern, every autonomous coding agent deployment is implicitly trusting a third party with write access to its reasoning.

Key takeaways:

• Router-side injection operates at a layer below all existing client-side defenses: the router can read, alter, or replace model outputs before the agent ever sees them, with no verification step in the current architecture.
• All four coding agents scored 0% defense success across all four injection levels; LLM review and execution whitelists reduced exposure at the margins but did not close the gap, and the dataset covers 400 samples across representative agentic workflows.
• Teams deploying autonomous coding agents through third-party API routing layers should treat the router as an untrusted intermediary and push for cryptographic or attestation-based output-integrity mechanisms at the provider level before expanding agent autonomy scope.

Source: Where Is the Cost of Third-Party API Routers in Agentic Software Development?