Man-in-the-Model: Man-in-the-Middle Attacks on Coding Agents via LLM Gateways
Man-in-the-Model
HiddenLayer researchers demonstrated that after attackers gain control of an LLM gateway or inference server, they can launch man-in-the-middle attacks against coding agents, passively inferring from timing differences between requests and responses which operations execute automatically and which require user approval. Across more than 4000 captured sessions, only 4.7% of short-duration tool calls fell into the ambiguous interval of their timing heuristic, versus 25.5% for shell calls. Attackers can also identify the agent in use via request headers and tool catalogs, read permission configurations from request content and files such as CLAUDE.md and AGENTS.md, and erase traces of injected reads before forwarding. In the demonstration, under Hermes's manual approval mode, injected file edits and python3 execution sent credentials from environment variables and ~/.ssh/id_rsa to an attacker webhook; for Codex, which has an approved git prefix, abusing Git's diff.external option allowed reading secrets in .env without approval.
The authors demonstrate that after an attacker controls an LLM gateway, they can infer the approval mode from timing and forge tool calls to steal local secrets; teams building their own proxies or gateways can use this to review their trust boundaries.