Router-Side Injection Beat Every Coding Agent Tested: 0% Defense Success Rate Across All Four Injection Levels

arXiv 2607.23624·high signal

A new empirical study (arXiv 2607.23624) shows that third-party LLM API routers — the OpenRouter-style layer that sits between a coding agent and the upstream provider — occupy the trusted path and can silently rewrite responses, with no mechanism verifying alignment between provider output and the repository actions the agent then executes. The authors built SIDEL, a trace record/replay/inject framework with a curated 400-sample dataset, and tested four escalating intervention levels (Response Substitution, Response Append, LLM-Polished, LLM-Polished with Distribution Alignment) against four representative coding agents. Without added mitigations, all four agents achieved a defense success rate of 0 percent at every injection level; whitelist execution control and LLM review improved resistance but did not restore end-to-end control. Code is at github.com/Riyasushin/SIDE.