Field report · · AgentConn Team
Your API Gateway Is Their Attack Surface
Nation-states build malicious wrappers on frontier model APIs to harvest credentials and training data. Here is what the agent ecosystem must do.
Your API Gateway Is Their Attack Surface
We spent the last two years worrying about what frontier models might do. We should have been worrying about what sits in front of them.
Anthropic’s September 2026 Threat Intelligence Report — the company’s most detailed casebook yet — documents eight months of adversarial operations against Claude. The headline-grabbing findings involve nation-state espionage and weapons research. But buried in the operational details is a pattern far more relevant to agent builders: the wrapper layer is the attack surface.
Not the model. Not the weights. Not the prompt. The proxy, the gateway, the relay service, the “discounted API access” — the front-end that sits between your agent and the frontier model it calls. That is where nation-state actors, criminal syndicates, and industrial-scale distillation campaigns are setting up shop.
If you read our coverage of agents attacking in the wild, you saw what happens when autonomous systems break out of sandboxes. This piece is the sequel: what happens when the infrastructure those agents rely on is hostile from the start.
Even Elon Musk weighed in, co-signing Anthropic CEO Dario Amodei’s framing of the threat — a rare moment of cross-industry alignment on the severity of AI-enabled attacks.
The Four-Vector Wrapper Attack
The threat reports from Anthropic and Google’s GTIG document four distinct ways attackers weaponize the wrapper layer. Each exploits a different assumption that agent builders make about their API gateway stack.
1. The Fraudulent Reseller
Anthropic’s report identifies GTG-50021, a Russian and Ukrainian-speaking group that created fraudulent services offering discounted Claude access. The operation was elegant in its simplicity: customers believed they were purchasing legitimate Claude API access. In reality, their traffic was silently proxied to a different, cheaper model while the reseller’s tooling installed a credential harvester that captured Anthropic account credentials, API keys, and session tokens.
The domains are known: awstore[.]cloud, kiro[.]cheap, deltaclient[.]xyz, holdboost[.]store. The credential harvester persisted on the victim’s device, “continued to identify any new sessions and sent them to the actor.” The stolen credentials fed a secondary market where other proxy services purchased fresh API keys to keep their own operations running.
This is not a one-off. A Tom’s Hardware investigation revealed an entire grey-market economy of API proxy services in China — known as “transfer stations” — reselling Claude access at 10% of official pricing. The business model is tripartite: stolen credentials for access, model substitution to cut costs, and harvesting users’ prompts and outputs for resale as training data.
View original article on Tom’s Hardware →
The math: If you are getting Claude API access at 90% off, you are not the customer. You are the product. Your prompts, your outputs, and your API credentials are all being harvested.
2. The Trojanized Gateway
On March 24, 2026, the self-proclaimed “TeamPCP” threat actor compromised LiteLLM on PyPI — the most widely deployed AI proxy library in production, present in 36% of cloud environments according to Wiz scanning data. Two poisoned versions (1.82.7 and 1.82.8) were live for about three hours.
Three hours was enough. The backdoored versions deployed a three-stage payload:
- Stage 1: A credential harvester targeting over 50 categories of secrets — AWS, GCP, Azure tokens, SSH keys, Kubernetes credentials
- Stage 2: A Kubernetes lateral movement toolkit capable of compromising entire clusters
- Stage 3: A persistent systemd backdoor polling for additional payloads
Version 1.82.8 was especially vicious: it used Python’s .pth file mechanism, which triggers on any Python invocation — meaning the malicious payload ran even if LiteLLM was never imported. We covered the broader implications in our LiteLLM breach analysis.
TeamPCP (tracked by Google as UNC6780) did not stop at LiteLLM. Their campaign spanned PyPI, npm, Docker Hub, GitHub Actions, and OpenVSX in a single coordinated operation — the most sophisticated multi-ecosystem AI supply chain attack publicly documented.
3. The Distillation Pipeline
Seven Chinese AI labs — Alibaba, Moonshot AI, DeepSeek, Zhipu, Xiaomi, SenseTime, and MiniMax — ran industrial-scale extraction campaigns that generated approximately 190 million exchanges with Claude between December 2025 and August 2026.
MiniMax’s approach was the most architecturally interesting: they built a proxy network service through a shell company that offered access to both Anthropic and OpenAI models. The service was real — it worked as advertised. But the purpose was data collection at scale: every user interaction with Claude through MiniMax’s proxy was captured for training data.
Moonshot AI and DeepSeek took it a step further. Anthropic’s report reveals that both companies silently forwarded customer requests to Claude instead of processing them with their own models, then displayed Claude’s responses as if they were their own. This means customers of these services were unknowingly exposing their queries — potentially including proprietary data and trade secrets — to a third party that was harvesting everything for model training.
Why this matters for agent builders: If your agent pipeline routes through a third-party API relay, you have no visibility into whether your queries are being intercepted, stored, or forwarded. Your agent’s entire operational context — tool calls, user data, system prompts — is traversing infrastructure you do not control.
4. The Weaponized Configuration
The most recent vector is perhaps the most insidious. Check Point researchers disclosed CVE-2025-59536 and CVE-2026-21852 — vulnerabilities allowing attackers to exfiltrate API tokens through malicious Claude Code project files.
The attack: place a crafted CLAUDE.md or .claude/ configuration in a repository. When a developer clones the repo and runs Claude Code, the configuration silently exfiltrates their API key to an attacker-controlled server. LayerX Security demonstrated how a malicious CLAUDE.md file could turn Claude Code into a nation-state-level offensive tool — no coding required from the attacker.
Google’s GTIG report confirms this vector is active in the wild: MIDNIGHT NEPTUNE (DPRK-nexus, formerly UNC1069) was observed “poisoning internal repository configurations with Claude CLI hooks” as part of cryptocurrency-targeting campaigns.
The Wrapper Enables the Model Abuse
Here is the pattern the threat reports make clear: in a majority of the operations documented, the model itself was used legitimately — within its terms of service — by the wrapper. The wrapper handled the illegality.
Consider the PROMPTSPY malware, documented by ESET. This Android backdoor captures an XML dump of the victim’s active screen, sends it to Google’s Gemini API as a legitimate API call, receives JSON instructions for which UI elements to tap, and executes those actions locally. Gemini is being used exactly as designed — answering questions about structured data. The malicious behavior lives entirely in the wrapper: the screen capture, the action execution, the persistence mechanism.
The same pattern appears in GTG-20006, the Midnight Blizzard-linked Russian espionage operation. The actors used Claude through “customized AI-driven workflows” for malware development, reconnaissance, and C2 infrastructure. Claude was not jailbroken. Claude was not tricked. Claude was called through an orchestration layer that structured the requests to stay within model capabilities while directing the output toward offensive operations.
As CyberScoop reported, Anthropic’s own finding is stark: “AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators.” The wrapper is how that collapse happens. The wrapper is what turns a general-purpose reasoning engine into a nation-state attack tool.
What the Community Is Saying
The Hacker News discussion on Anthropic’s report (186 points, 243 comments) reveals a community split on the implications.
View discussion on Hacker News →
The sharpest thread concerns the distillation campaigns. One commenter questioned the financial logic: “Chinese AI providers have razor-thin margins — these claims seem dubious.” The rebuttal was pointed: forwarding customer requests to Claude “likely aims at obtaining user conversations for model distillation training rather than cost savings.” The wrapper was not about delivering cheaper inference. It was about capturing the interactions — the real-world queries, tool calls, and reasoning chains that no synthetic dataset can replicate.
View full analysis on CellCog →
The CellCog analysis captures the emerging consensus among platform builders: “The API key is the loot.” The operating model Anthropic first documented in November 2025 — agents running attacks — has spread to every class of actor. But what changed is the target: attackers now steal AI credentials on purpose, not as a side effect of broader compromise, because those credentials unlock compute worth thousands per hour.
Not everyone is buying the threat framing uncritically. Developer KC Nygaard pushed back on the “out-of-control AI” narrative, noting that companies had all the control in the world to prevent these incidents — and chose not to exercise it.
Contrarian Corner: The “wrapper as threat” framing also serves Anthropic’s commercial interests. Making independent proxies and wrappers seem inherently suspect reinforces vendor lock-in. Most proxy services exist because official APIs are expensive or region-locked. The real question is whether locking down the wrapper layer protects users — or just protects margins. This is a legitimate tension. But the evidence from the threat reports does not support dismissing it as marketing. GTG-50021 was harvesting credentials. MiniMax was siphoning training data. TeamPCP was backdooring clusters through compromised gateway libraries. The fact that some independent proxies are benign does not make the attack surface less real.
The Government Response
Regulators are starting to notice. Singapore’s Cyber Security Agency issued an advisory in April 2026 — a rare out-of-cycle alert mailed directly to Critical Information Infrastructure boards — warning that frontier AI models can “reduce the time taken to identify vulnerabilities and engineer exploits from months to hours.” The advisory is non-binding but signals that governments are now treating the AI wrapper layer as critical infrastructure.
In the United States, a June 2026 executive order calls for frontier model security and early government access — an acknowledgment that the attack surface extends well beyond the model weights.
The policy response is lagging behind the threat. The Singapore advisory asks boards to review risk posture. The US order establishes reporting requirements. Neither addresses the fundamental problem: the AI gateway supply chain has no security standard, no audit requirement, and no chain-of-custody verification.
What This Means for Agent Builders
If you are building or deploying AI agents in production, the wrapper attack surface is now your responsibility. Here is a concrete threat model and defense checklist.
Threat model your gateway stack:
- Do you route API calls through any third-party proxy, relay, or gateway service?
- If yes, who controls that infrastructure, and what visibility do you have into how requests are handled?
- Is your gateway library (LiteLLM, custom proxy, cloud gateway) pinned to a verified version?
- Are your API keys stored with the same rigor as database credentials?
Five immediate actions:
-
Pin and verify gateway dependencies. LiteLLM, LangChain, any SDK wrapper — pin exact versions, verify checksums, and sign your lock files. The LiteLLM attack exploited the gap between “latest” and “verified.”
-
Treat API keys as crown jewels. Rotate them on the same cadence as database passwords. Use short-lived tokens where available. Monitor for anomalous usage patterns — a sudden spike in Opus-class calls from a service that normally uses Haiku is a signal.
-
Audit third-party AI services. If you consume any “discounted” or “unified” AI API access, verify the traffic is going where you think it is. Inspect TLS certificates. Check that model responses match expected behavior for the model you are paying for.
-
Isolate agent credentials. The CellCog model is right: every agent workspace should have credentials scoped per agent and enforced server-side. Never share API keys across agents or environments.
-
Scan repository configurations. Before running any AI coding assistant on a cloned repo, review
.claude/,CLAUDE.md,.cursor/,.continue/, and similar AI configuration files. The config-as-attack-surface vector is now actively exploited.
Bottom line: The frontier model is the hardest thing in your stack to compromise. The wrapper around it is the softest. Nation-state actors know this. Now you do too.
Looking Ahead
The convergence documented in these threat reports — state espionage, criminal credential harvesting, and industrial distillation all flowing through wrapper infrastructure — is not a coincidence. It is an emergent property of how the AI ecosystem was built: powerful models behind APIs, with an unregulated intermediary layer connecting them to users.
The agent collusion risks we documented are about what happens when agents coordinate within sandboxes. The wrapper attack surface is about what happens when the sandbox itself is hostile.
We expect three developments in the next six months:
- Gateway security standards from at least one major cloud provider, likely modeled on the existing API gateway security frameworks
- Supply chain attestation requirements for AI proxy libraries, driven by incidents like LiteLLM
- Model-level traffic validation — frontier model providers building server-side detection for proxy interception, moving beyond the current account-level bans
The wrapper was supposed to be a convenience layer. It became the attack surface. Build accordingly.