The Proxy Knows Too Much: Sealing LLM API Routers with Attested TEEs

Researchers propose AEGIS, a hardware-enclave-based system designed to prevent large language model API routers from reading or altering plaintext interactions between AI agents and model providers, according to a paper posted to arXiv on June 15 [1]. The paper argues that as autonomous agents increasingly rely on large language models through API routers, those routers become application-layer man-in-the-middle points. A router terminates the client's transport-layer security session and opens a separate upstream session, holding the full interaction in plaintext [1]. This position allows a compromised or malicious router to rewrite agent tool calls, swap software dependencies for typosquatted packages, trigger attacks only under audit-evading conditions, or passively exfiltrate secrets [1]. The authors note that existing client-side defenses are evadable [1]. AEGIS addresses this by confining all plaintext handling to a small hardware-enclave component, while authentication, scheduling, accounting, and management functions remain on an untrusted host [1]. Before releasing plaintext, the client verifies the enclave, ensuring the host can neither read nor alter the interaction and that plaintext leaves only toward destinations fixed by the measured image [1]. The trusted path comprises 851 lines of code and supports three provider-native APIs without conversion [1]. In testing, the system completed every request under real-provider workload and concurrency, with local relay overhead of about six milliseconds per request [1]. A seeded audit pilot had two commodity coding agents search for planted invariant violations; one agent found eight of ten violations and the other found all ten [1]. The paper shows that all four malicious-router attack classes succeed against a plaintext-access baseline and are blocked by AEGIS, including adaptive tests against the same boundary [1]. The paper was submitted to the arXiv repository, an open-access platform that hosts electronic preprints across fields including computer science, mathematics, and physics [6]. arXiv, which began in 1991, passed two million articles by the end of 2021 and receives roughly 24,000 submissions per month as of late 2024 [6]. The repository also supports experimental community tools through its arXivLabs framework, which allows third-party collaborators to develop features such as citation explorers and recommender systems while adhering to user data privacy requirements [4].