Do not hand code, keys, or private material to unknown “AI proxy gateways,” especially when letting AI run commands automatically

A proxy sits between you and the model vendor; it can see and alter what you send and what comes back. Researchers measured more than 400 proxies: 9 injected malicious code into replies, and 17 tampered with cloud service keys the researchers had planted on purpose. Where AI runs commands automatically, a single altered command can be enough for someone to install malicious code on the computer.

Cost

Official direct access is usually pricier than proxy gateways, and topping up is less convenient. The hard part is that a proxy is cheap, and a single entry point can call several model vendors

Benefit

In June 2026 the Ministry of State Security issued a risk alert. Some proxies retain user submissions on servers; some intercept privately and resell data to other model vendors for training. Some hide backdoors that implant malicious code on user devices, steal account keys and cloud credentials, or even install remote-control software. The alert recommends official direct connections or properly licensed platforms, and not using platforms of unknown origin without operating credentials or security safeguards. Desensitize personal privacy and project material before use, manage keys, and rotate them on a schedule. On abnormal billing, unexplained account bans, or odd data, stop use immediately, rotate keys, run antivirus, and preserve evidence. Researchers from UC Santa Barbara and others measured this in 2026. They bought 28 paid proxies from Taobao (淘宝), Xianyu (闲鱼), and overseas shops, and collected 400 free proxies from public communities. 1 paid proxy and 8 free ones injected malicious code into returned tool calls. Tool calls are commands AI has your computer run, such as installing a package. 2 timed their attacks; the paper’s example is targeting only fully automated sessions. 17 touched Amazon Web Services keys the researchers had planted on purpose. 1 moved funds from a researcher’s Ethereum wallet; the wallet held very little, and the loss was under 50 US dollars. The demonstrated tampering was subtle: swap requests for the near-identical reqeusts in an install command, hard to spot at a glance (nationwide)

Notes

Rated B because there is only one study, and it is a preprint (a version released before formal publication). Most measured proxies were free; only 28 were paid, so you cannot infer what share of all proxies are malicious. Some media wrote that theft as 500000 US dollars; the paper says under 50 US dollars. Benefit magnitude is set at medium by consequence: loss from stolen keys and code varies widely, and the study has no amount to apply mechanically. If you already used an unknown proxy, revoke and regenerate keys at the model vendor, and rotate cloud and repository keys together. When traffic goes through a proxy, do not let AI run commands fully automatically; review commands before allowing them. Operators running proxy gateways face criminal liability; see Section 11, item 19 (AI proxy gateways). The beneficiary is you.

Sources · 1

1. 国家安全部 (2026). 「AI中转站」，风险要防范. szzg.gov.cn/2026/xwzx/szkx/202606/t20260608_5…（数字中国建设峰会官网转载国家安全部微信公众号）；Liu H, Shou C, Wen H, Chen Y, Fang RJ, Feng Y. (2026). Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain. arXiv:2604.08407. arxiv.org/abs/2604.08407