AI routers expose crypto wallets to theft: researchers warn

Researchers found 26 AI routers injecting malicious code and stealing crypto credentials. Experts warn against sending private keys through AI-assisted tools.

Recent research from the University of California highlights significant security risks posed by third-party AI large language model (LLM) routers. These routers, which aggregate and route API requests to providers like OpenAI, Anthropic, and Google, have been found to expose users to threats such as cryptocurrency and cloud credential theft. Researchers identified 26 compromised routers that actively inject malicious code and steal credentials by exploiting their access to plaintext data. Because these routers terminate encrypted connections, they gain full access to sensitive information, including private keys and seed phrases. In controlled tests, one router drained Ether from a decoy wallet, while others accessed Amazon Web Services credentials. Features like “YOLO mode,” which allows AI agents to execute commands without user approval, further increase the risk. Security experts strongly advise against transmitting private cryptographic keys through AI-assisted development environments and urge caution when using third-party AI routing services in crypto workflows.