# The Proxy Knows Too Much: Sealing LLM API Routers with Attested TEEs

arXiv: https://arxiv.org/abs/2606.16358 · HTML: https://mlsanity.com/paper/2606.16358/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 51 references that are in the map.
- First posted on arXiv 15 Jun 2026.

## Builds on (most cited first, 14 of 14)

- [ReAct: Synergizing Reasoning and Acting in Language Models](https://mlsanity.com/paper/2210.03629/) (2022)
- [SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering](https://mlsanity.com/paper/2405.15793/) (2024)
- [Defeating Prompt Injections by Design](https://mlsanity.com/paper/2503.18813/) (2025)
- [LlamaFirewall: An open source guardrail system for building secure AI agents](https://mlsanity.com/paper/2505.03574/) (2025)
- [Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware](https://mlsanity.com/paper/1806.03287/) (2018)
- [What Was Your Prompt? A Remote Keylogging Attack on AI Assistants](https://mlsanity.com/paper/2403.09751/) (2024)
- [No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device ML](https://mlsanity.com/paper/2310.07152/) (2023)
- [Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain](https://mlsanity.com/paper/2604.08407/) (2026)
- [PipeLLM: Fast and Confidential Large Language Model Services with Speculative Pipelined Encryption](https://mlsanity.com/paper/2411.03357/) (2024)
- [Integrating Remote Attestation with Transport Layer Security](https://mlsanity.com/paper/1801.05863/) (2018)
- [AEX: Non-Intrusive Multi-Hop Attestation and Provenance for LLM APIs](https://mlsanity.com/paper/2603.14283/) (2026)
- [Attestable Builds: Compiling Verifiable Binaries on Untrusted Systems using Trusted Execution Environments](https://mlsanity.com/paper/2505.02521/) (2025)
- [On the TOCTOU Problem in Remote Attestation](https://mlsanity.com/paper/2005.03873/) (2020)
- [Nitriding: A tool kit for building scalable, networked, secure enclaves](https://mlsanity.com/paper/2206.04123/) (2022)

## Built on by (most cited first, 1 of 1)

- [Where Is the Tradeoff in Using Third-Party API Routers for Agentic Software Development?](https://mlsanity.com/paper/2607.23624/) (2026)

## Abstract (arXiv)

Agents increasingly access large language models (LLMs) through API routers. A router terminates the client's transport-layer security session and opens a separate upstream session, so it holds the full interaction in plaintext. This makes the router an application-layer man-in-the-middle: it can rewrite agent tool calls, swap dependencies for typosquatted packages, trigger attacks only under audit-evading conditions, and passively exfiltrate secrets. Existing client-side defenses are evadable. We propose AEGIS, a provider-transparent attested API router whose data path is a client-verified faithful passthrough. AEGISconfines plaintext handling to a small hardware-enclave component while leaving authentication, scheduling, accounting, and management on the untrusted host. The client verifies the enclave before releasing plaintext. The host can neither read nor alter the interaction, and plaintext leaves only toward destinations fixed by the measured image. We show that all four malicious-router attack classes succeed against a plaintext-access baseline and are blocked by AEGIS, including adaptive tests against the same boundary. The trusted path is 851 lines, carries three provider-native APIs without conversion, and completes every request under real-provider workload and concurrency. In a seeded audit pilot, two commodity coding agents find eight and ten of ten planted invariant violations. The local relay overhead is about six milliseconds per request.