The Proxy Knows Too Much: Sealing LLM API Routers with Attested TEEs
2026-06-15 • Cryptography and Security
Cryptography and SecurityArtificial IntelligenceEmerging TechnologiesMultiagent Systems
AI summaryⓘ
The authors explain that current API routers used to connect agents to large language models can see and change all the data passing through them, which is risky. They created AEGIS, a system that keeps sensitive information secure by running the critical parts inside a protected hardware enclave that the client checks before sharing data. This setup stops the router from spying or messing with the communication. Their tests show AEGIS effectively blocks different types of attacks that can happen with normal routers.
API routerlarge language model (LLM)client-server securityhardware enclaveman-in-the-middle attackplaintextattestationsecurity boundarytrusted computingsoftware integrity
Authors
Sipeng Xie, Qianhong Wu, Hengrun Lu, Ziliang Sun, Qi Wu, Bo Qin, Qin Wang
Abstract
Agents increasingly access large language models (LLMs) through API routers. A router terminates the client's transport-layer security session and opens a separate upstream session, so it holds the full interaction in plaintext. This makes the router an application-layer man-in-the-middle: it can rewrite agent tool calls, swap dependencies for typosquatted packages, trigger attacks only under audit-evading conditions, and passively exfiltrate secrets. Existing client-side defenses are evadable. We propose AEGIS, a provider-transparent attested API router whose data path is a client-verified faithful passthrough. AEGISconfines plaintext handling to a small hardware-enclave component while leaving authentication, scheduling, accounting, and management on the untrusted host. The client verifies the enclave before releasing plaintext. The host can neither read nor alter the interaction, and plaintext leaves only toward destinations fixed by the measured image. We show that all four malicious-router attack classes succeed against a plaintext-access baseline and are blocked by AEGIS, including adaptive tests against the same boundary. The trusted path is $851$ lines, carries three provider-native APIs without conversion, and completes every request under real-provider workload and concurrency. In a seeded audit pilot, two commodity coding agents find eight and ten of ten planted invariant violations. The local relay overhead is about six milliseconds per request.