LLM Provider Substitution - DeepSeek Model on Anthropic Wire Protocol
This detects a mismatch inside a single outbound request: it looks like a normal Anthropic Claude API call, complete with an Anthropic key and API format, but the model field names a DeepSeek model instead. That mismatch is the signature of a compatibility proxy quietly swapping the backend that actually serves your requests.
How the attack works
A tool such as Claude Code or the Anthropic SDK is configured, or reconfigured by a malicious package, to send its requests through a proxy instead of directly to Anthropic. The outgoing request still looks like an Anthropic call — same URL path, same Anthropic-only fields, same sk-ant- key, same Claude Code system preamble — because the client software hasn't changed. But the proxy rewrites or sets the model field to a DeepSeek model name before the request is actually served, meaning your prompts, code, and Anthropic credential are now going to a DeepSeek-backed service instead of Anthropic. This can happen even when the proxy runs locally on the same machine (e.g. 127.0.0.1), so there's no unusual external destination to notice.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 3f7c2a91-5d84-4e63-9b1a-7c0e8d2f4a16
- Severity
- High
Why it matters
Prompts, source code, and other data sent to what you believe is Anthropic's Claude are actually processed by a different, unverified backend, and your Anthropic API key is exposed to that backend. This is a narrow signal of the substitution itself — it does not tell you how the proxy got installed or what else it may be doing.
What you can do
- →Inventory which hosts and processes are legitimately allowed to front Anthropic-compatible traffic with alternate backends (approved cost-optimization gateways, LiteLLM/OpenRouter routers, internal shims) and treat any request matching this pattern from elsewhere as suspicious.
- →When this pattern appears, check whether it was an intentional routing decision by the team; if so, document and allow-list that specific host or proxy rather than treating every occurrence as an incident.
- →Audit installed packages and dependencies for unexpected local proxies or SDK shims that intercept API calls, especially ones listening on localhost.
- →Rotate the Anthropic API key if the substitution was not intentional, since the key was transmitted to an unverified backend.
Known benign look-alikes
- Sanctioned cost-optimisation gateways. Some teams deliberately point Claude Code or the Anthropic SDK at DeepSeek's Anthropic-compatible endpoint. The wire signature is identical to the malicious proxy, which is why this rule reports rather than blocks - the platform owner triages once and, if the gateway is approved, fronts this rule with their own allow rule.
- Model routers and proxies (LiteLLM, OpenRouter, internal LLM gateways, Bedrock/Vertex shims) that accept Anthropic-shaped requests and forward a deepseek-* model name. Expected to be a small, stable set of hosts per tenant; triage once.
- Compatibility/conformance CI suites that replay Anthropic Messages payloads against a DeepSeek backend. Usually distinguishable by placeholder keys, which filter_placeholders already suppresses.
- A developer pasting a DeepSeek proxy configuration into a Claude prompt for review. The model name is then escaped inside a JSON string, which filter_escaped_payload suppresses.
- Security research or advisory content about the 'deeptunnel' package fetched or discussed by the agent - suppressed when it carries placeholder credentials or appears as escaped JSON inside a message body.