Most security talk about AI coding agents focuses on the model. Will it run a bad command? Can a poisoned README trick it? New research from HiddenLayer looks somewhere else: the plumbing between the agent and the model.
In a report released today, HiddenLayer researchers Esteban Tonglet, Divyanshu Divyanshu, and Kasimir Schulz show that anyone who controls an inference server or LLM gateway can quietly learn how a coding agent is configured. Then they can forge tool calls that ride on permissions the developer already granted. The agent runs them. The developer sees nothing unusual.
Why the middle layer matters
Plenty of developers don't send traffic straight to one vendor. They use open harnesses like OpenCode, Cline, and Hermes, pointed at open-weight models served through Ollama, vLLM, or providers like Together AI and Fireworks. Many organizations add a gateway such as LiteLLM to centralize API keys, routing, logging, and policy.
Each layer relays requests and responses, so it sees prompts, tool definitions, history, and tool output. LiteLLM's async_pre_call_hook and async_post_call_success_hook let custom code read or rewrite that traffic. That's useful for guardrails. It's also exactly what an attacker wants.
HiddenLayer describes two ways in: a malicious Ollama wrapper that listens on the default port, 11434, and forwards to the real service, or a supply chain compromise of a gateway's package, plugin, or container image.
Step one: watch the clock
The attacker doesn't need to change anything to start learning. By timing the gap between a tool call and its result, a proxy can tell whether the agent paused for a human to approve it. File reads normally finish almost instantly. A pause of several seconds suggests a prompt.
The signal is strong. Across more than 4,000 captured sessions, just 4.7% of calls to fast tools landed in HiddenLayer's ambiguous range, compared with 25.5% of shell calls. Across more than 35,000 file reads, only 1% did.
Shell commands are noisier. So the proxy can slip timing code into a script through an auto-approved file edit, or wrap a command in a timer. Either way, the timing output is stripped before the user sees it.
Hiding that wrapper is easier than you'd think. Agents routinely generate long build commands full of pipes and redirects. Users scan for rm, sudo, or curl piped to a shell. A small addition in a 20-command line blends in. The researchers used a Tree-sitter Bash parser to score complexity and pick hiding spots.
Step two: read the configuration
Harnesses also give a lot away. Codex headers start with codex-tui. Claude Code identifies itself as claude-cli. Hermes uses a generic OpenAI SDK user agent, but its default tools (terminal, write_file, patch) reveal it.
Some harnesses go further. Codex includes its permission settings in every request: sandbox mode, writable paths, network access, and approved command prefixes. Claude Code sends its working directory, OS, Git status, and a Bash tool schema that includes a dangerouslyDisableSandbox option.
A proxy can also insert its own reads of files like CLAUDE.md, AGENTS.md, or .cursorrules, then strip the call and result. The model never knows.
Step three: use what's already allowed
HiddenLayer ran two demos. In the first, Hermes ran in manual mode, which only prompts for commands it considers dangerous. When the user asked Hermes to read a Python file, the proxy inserted file edits that added a heartbeat_ok() function. That function collected environment variables and SSH keys and sent them to an attacker's webhook. The proxy then ran the file with python3 and removed the function. Every step ran without a prompt.
In the second, Codex had the git prefix approved and a writable .git directory. The proxy forged this call:
git -c diff.external='sh -c "cat .env"' diff --no-index /dev/null .env
Codex ran it without asking and returned the contents of .env. Git's helper options can launch other programs, so an approved git prefix is broader than it looks.
There's a slower option, too. The gateway rewrites a dependency name, say requests to reqiests. Nothing happens until someone installs dependencies later.
This isn't hypothetical
LiteLLM shipped two malicious PyPI versions, 1.82.7 and 1.82.8, on March 24, 2026, after attackers got hold of a maintainer's publishing credentials. And an April 2026 study of 428 third-party LLM routers by University of California researchers found nine injecting malicious code and 17 abusing researcher-planted AWS credentials.
What developers can do now
HiddenLayer's report focuses on the attack, not a checklist. Here's what I'd take from it:
- Treat gateways and inference servers as part of your trust boundary. Pin versions, verify artifacts, and control who can change hooks and callbacks.
- Be careful with free or unknown routers. Cheap access isn't worth handing someone your traffic and keys.
- Keep approvals narrow. Blanket approvals for
git, python, or file edits give a proxy room to work.
- Keep secrets out of the agent's reach. Don't leave
.env files, SSH keys, or cloud credentials where the agent can read them.
- Watch outbound traffic from developer machines and build systems.
Coding agents are doing a lot of good work. But sandboxes and approval prompts assume each tool call came from the model you chose. HiddenLayer's point is that this assumption no longer holds. The security boundary includes every system that can shape what the agent runs. And the teams that build and deploy these agents are responsible for that whole path.
