Agents increasingly access large language models (LLMs) through API routers. A router terminates the client's transport-layer security session and opens a separate upstream session, so it holds the full interaction in plaintext. This makes the router an application-layer man-in-the-middle: it can rewrite agent tool calls, swap dependencies for typosquatted packages, trigger attacks only under audit-evading conditions, and passively exfiltrate secrets. Existing client-side defenses are evadable. We propose AEGIS, a provider-transparent attested API router whose data path is a client-verified faithful passthrough. AEGISconfines plaintext handling to a small hardware-enclave component while leaving authentication, scheduling, accounting, and management on the untrusted host. The client verifies the enclave before releasing plaintext. The host can neither read nor alter the interaction, and plaintext leaves only toward destinations fixed by the measured image. We show that all four malicious-router attack classes succeed against a plaintext-access baseline and are blocked by AEGIS, including adaptive tests against the same boundary. The trusted path is $851$ lines, carries three provider-native APIs without conversion, and completes every request under real-provider workload and concurrency. In a seeded audit pilot, two commodity coding agents find eight and ten of ten planted invariant violations. The local relay overhead is about six milliseconds per request.

翻译：代理越来越多地通过API路由器访问大型语言模型（LLM）。路由器终止客户端的传输层安全会话并建立独立的上游会话，因此能够以明文形式持有完整交互内容。这使得路由器成为应用层中间人：它可以改写代理工具调用、将依赖项替换为拼写错误域名劫持的软件包、仅在规避审计的条件下触发攻击，以及被动泄露机密。现有客户端防御措施可被规避。我们提出AEGIS——一种对提供商透明的经证明的API路由器，其数据路径是经客户端验证的忠实直通。AEGIS将明文处理限制在小型硬件飞地组件中，同时将身份验证、调度、记账和管理功能保留在非可信主机上。客户端在释放明文前验证飞地。主机既不能读取也不能篡改交互内容，且明文仅流向由测量映像确定的固定目的地。我们证明所有四类恶意路由器攻击均能成功突破明文访问基线，而AEGIS可阻断这些攻击，包括针对相同边界的自适应测试。可信路径包含851行代码，支持三种提供商原生API且无需转换，并在真实提供商负载和并发条件下完成每个请求。在种子审计试点中，两款商用编码代理分别发现十个植入不变量违规中的八个和十个。本地中继开销约为每请求六毫秒。