LiteLLM callback hooks let an attacker who already holds gateway admin forge tool calls after inference — downstream of every prompt-level defence
An attacker who already holds administrative access to a LiteLLM proxy — through leaked master-key or proxy-admin credentials, a prior vulnerability chain, or a supply-chain compromise — can use the gateway's legitimate model-update management API to change a model's configured backend address, silently routing that model's traffic through infrastructure they control and exposing the provider API keys that resolve at request time (Cloud Security Alliance, 2026-08-05). With traffic rerouted, the interesting part is what the relay does next: it abuses LiteLLM's own post-call callback hooks, the extension points the platform provides for logging and response processing, so that an attacker in control of these hooks can inject arbitrary text into a response or, more consequentially, forge a tool call that was never produced by the underlying model (Cloud Security Alliance, 2026-08-05). The technique originates in research published two days earlier under the handle wunderwuzzi (Embrace The Red, 2026-08-03).
The consequence worth internalising is architectural rather than novel-exploit. Because the manipulation happens after the model has already generated its output, it bypasses prompt-level defenses entirely (Cloud Security Alliance, 2026-08-05). Every control an organisation has invested in at the prompt layer — system-prompt hardening, input filtering, injection detection, guardrail models — sits upstream of the tamper point and cannot see it. If the agent downstream of the gateway acts on tool calls, a forged tool call is an instruction to act, and it arrives carrying the gateway's own authenticity.
This is post-compromise, and that framing should govern how urgently it is treated: it is not a way in, it is what a foothold on the gateway is worth. But it inverts a common assumption about AI-agent architecture, in which the gateway is treated as plumbing and its admin credential as ordinary application configuration. On this evidence the gateway is a control-plane component whose compromise is not contained by anything downstream of it. The reporting also notes that a capable attacker reverts the rerouted configuration once finished, which removes the most visible artifact of the compromise (Cloud Security Alliance, 2026-08-05) — so a point-in-time configuration review is exactly the check that will come back clean.
Triage: legitimate operations change model configuration too — adding models, moving between regions, failing over to a secondary provider. The discriminators are that the change is made outside a deployment pipeline or change window, that the new backend address is not one of the organisation's known provider or proxy endpoints, and above all that the configuration is changed and then changed back within a short interval, which is not a shape ordinary operational work produces.
forge a tool call that was never produced by the underlying model
bypasses prompt-level defenses entirely
Defender actions
- Turn on audit logging for LiteLLM's management API if it is not already recording, and alert on any change to a model's api_base or proxy setting — that configuration write is the one step of this chain that must happen before anything else and the one the attacker later reverts.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Credential Access TA0006
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Collection TA0009
T1557Adversary-in-the-Middle
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Impact TA0040
T1565.002Data Manipulation: Transmitted Data Manipulation
Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data. By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.