# LLM Provider Substitution - DeepSeek Model on Anthropic Wire Protocol

- **Severity:** High
- **Signature ID:** `3f7c2a91-5d84-4e63-9b1a-7c0e8d2f4a16`
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise)
- **OWASP:** LLM03 (Supply Chain), LLM02 (Sensitive Information Disclosure)

## Summary

This detects a mismatch inside a single outbound request: it looks like a normal Anthropic Claude API call, complete with an Anthropic key and API format, but the model field names a DeepSeek model instead. That mismatch is the signature of a compatibility proxy quietly swapping the backend that actually serves your requests.

## How the attack works

A tool such as Claude Code or the Anthropic SDK is configured, or reconfigured by a malicious package, to send its requests through a proxy instead of directly to Anthropic. The outgoing request still looks like an Anthropic call — same URL path, same Anthropic-only fields, same sk-ant- key, same Claude Code system preamble — because the client software hasn't changed. But the proxy rewrites or sets the model field to a DeepSeek model name before the request is actually served, meaning your prompts, code, and Anthropic credential are now going to a DeepSeek-backed service instead of Anthropic. This can happen even when the proxy runs locally on the same machine (e.g. 127.0.0.1), so there's no unusual external destination to notice.

## Why it matters

Prompts, source code, and other data sent to what you believe is Anthropic's Claude are actually processed by a different, unverified backend, and your Anthropic API key is exposed to that backend. This is a narrow signal of the substitution itself — it does not tell you how the proxy got installed or what else it may be doing.

## What you can do

- Inventory which hosts and processes are legitimately allowed to front Anthropic-compatible traffic with alternate backends (approved cost-optimization gateways, LiteLLM/OpenRouter routers, internal shims) and treat any request matching this pattern from elsewhere as suspicious.
- When this pattern appears, check whether it was an intentional routing decision by the team; if so, document and allow-list that specific host or proxy rather than treating every occurrence as an incident.
- Audit installed packages and dependencies for unexpected local proxies or SDK shims that intercept API calls, especially ones listening on localhost.
- Rotate the Anthropic API key if the substitution was not intentional, since the key was transmitted to an unverified backend.

## Known benign look-alikes

- Sanctioned cost-optimisation gateways. Some teams deliberately point Claude Code or the Anthropic SDK at DeepSeek's Anthropic-compatible endpoint. The wire signature is identical to the malicious proxy, which is why this rule reports rather than blocks - the platform owner triages once and, if the gateway is approved, fronts this rule with their own allow rule.
- Model routers and proxies (LiteLLM, OpenRouter, internal LLM gateways, Bedrock/Vertex shims) that accept Anthropic-shaped requests and forward a deepseek-* model name. Expected to be a small, stable set of hosts per tenant; triage once.
- Compatibility/conformance CI suites that replay Anthropic Messages payloads against a DeepSeek backend. Usually distinguishable by placeholder keys, which filter_placeholders already suppresses.
- A developer pasting a DeepSeek proxy configuration into a Claude prompt for review. The model name is then escaped inside a JSON string, which filter_escaped_payload suppresses.
- Security research or advisory content about the 'deeptunnel' package fetched or discussed by the agent - suppressed when it carries placeholder credentials or appears as escaped JSON inside a message body.

## References

- https://docs.anthropic.com/en/api/messages
- https://owasp.org/www-project-top-10-for-large-language-model-applications/

---
Source: https://www.netzilo.com/threats/deepseek-anthropic-wire-proxy