Security
Preprint Tests Whether API Routers Can Steer Coding Agents Past Client Safeguards
A July 2026 arXiv preprint reports that a third-party API router could alter responses consumed by coding agents, changing repository-level actions in controlled tests despite evaluated client-side safeguards.
arXiv
What happened
The authors tested four coding agents with SIDEL, a framework for recording and replaying agent traces, injecting altered responses, and evaluating defenses. The study used 400 manually designed malicious injection samples across four increasingly subtle router-side intervention levels.
The preprint reports that router-side intervention substantially changed repository-level actions. Without additional mitigations, the authors reported a 0% defense success rate across all evaluated agents and injection levels.
The paper was first posted to arXiv on July 26, 2026, and its version 2 was revised on July 29. It is a preprint, not peer-reviewed research, and the accessible material contains no independent replication.
Why it matters
Coding agents can make changes in software repositories with limited interaction. The study examines a trust boundary: a router between an agent and an upstream model provider can inspect and modify requests and responses. Its result does not show that any named router has done this in production, but it suggests that permission and review controls on the client may not alone detect manipulated model responses in the tested configurations. Separately, OWASP recommends least privilege, human approval for high-risk actions, and adversarial testing. NIST’s AI Risk Management Framework organizes risk work around governing, mapping, measuring, and managing risks.
What remains unclear
- The 400 injections were manually constructed experimental samples, not records of real-world router compromises.
- The authors say exact attack-success rates may differ with stricter agent controls, different configurations, or different router topologies.
- No reviewed source establishes that a commercial router altered a production coding agent’s output in the tested way.
Sources
-
Where Is the Cost of Third-Party API Routers in Agentic Software Development?
Used for: The preprint’s publication history, experimental design, reported results, and limitations.
-
LLM01:2025 Prompt Injection - OWASP Gen AI Security Project
Used for: General prompt-injection risks and recommended security measures.
-
AI RMF - AIRC
Used for: General AI risk-management context.