LLM Control Plane Relay (Duplicated Vendor API Surface)

How the attack works

A malicious 'hook' package installs itself into a developer's environment and quietly rewrites the coding agent's configured API base URL, or mirrors its outgoing calls to a second location. Because the request formats for Anthropic, Codex, and Gemini are vendor-specific and normally go to exactly one endpoint, seeing the same proprietary request shape hit two different endpoints for one agent is the giveaway. The rule watches outbound HTTP requests tied to a single monitored agent and flags when its control-plane traffic fans out to more than one endpoint in a one-hour window.

Netzilo detection

Why it matters

If real, this means an attacker or unauthorized proxy can see or capture everything the coding agent sends to the AI model, including source code, credentials, and other sensitive context pulled into prompts. The rule only detects the network symptom, it cannot confirm which package or mechanism caused it, so every hit needs human review.

What you can do

• →Identify the second endpoint and confirm whether it's an approved internal gateway (LiteLLM, Portkey, Helicone, an internal Bedrock/Vertex bridge) before treating it as malicious.
• →If unapproved, inspect the developer's environment for packages that modify HTTP clients or environment variables controlling the agent's base URL.
• →Maintain an allowlist of sanctioned LLM gateway endpoints so triage can quickly separate known proxies from unknown ones.
• →Review recently installed Python/Node packages in developer environments for ones that patch or wrap outbound request libraries.

Known benign look-alikes

• Sanctioned enterprise LLM gateway (LiteLLM, Portkey, Helicone, an internal Bedrock/Vertex bridge) that re-exposes the Anthropic Messages or Codex backend surface while the same agent also reaches the vendor directly. This is a legitimate man-in-the-middle and is not distinguishable from a malicious one on network shape alone - triage by asking whether the second endpoint is an approved gateway.
• Developer running a local or self-hosted Anthropic-compatible endpoint (claude-code-router, litellm, a proxy on 127.0.0.1) alongside direct vendor access.
• Agent switched between staging and production endpoints of the same vendor, or between a vendor host and a regional / enterprise alias, inside the same hour.
• Deliberate traffic capture or replay tooling (mitmproxy, VCR-style fixtures) used during development of the agent itself.
• Multiple agents on one host collapsing onto the same path-keyed Process node; mitigated by requiring both endpoints on that agent's own HTTP_REQUEST edges.

References

• https://attack.mitre.org/techniques/T1557/
• https://attack.mitre.org/techniques/T1195/002/
• https://owasp.org/www-project-top-10-for-large-language-model-applications/

Related threats