Sandboxes and approval prompts assume the model response is honest about which tools it asked for. A hostile gateway can rewrite that assumption in transit.
On 22 October 2026, HiddenLayer published "Man-in-the-Model: Hijacking Coding Agents in Transit," credited to Esteban Tonglet, Divyanshu Divyanshu, and Kasimir Schulz. The research treats LiteLLM-style hooks, Ollama wrappers, and other inference intermediaries as a privileged position over coding-agent traffic. The deliverable is a class analysis of that position rather than a CVE catalogue.
A hostile gateway fingerprints the harness, then forges tool calls inside granted scopes
The attack chain starts with position. Whoever controls the inference server or the gateway that translates harness requests can inspect prompts, tool catalogues, and conversation history, then alter responses before they reach Claude Code, Codex, Hermes, or similar agents.
Passive timing comes next. By measuring the delay between a tool call and its result, the intermediary can often distinguish automatically permitted actions from those waiting on user approval, especially for short file reads and edits. HiddenLayer reports that in more than four thousand captured sessions, only 4.7% of short-runtime tool calls fell in an ambiguous timing band, versus 25.5% of shell calls. Debug and CLI timing tricks insert instrumentation via already-trusted file edits or shell wrappers when passive signals are insufficient.
Harness fingerprinting uses headers (for example Codex codex-tui and Claude Code claude-cli), tool-catalogue shapes, and on-disk project files such as CLAUDE.md, AGENTS.md, or .cursorrules. Once the permission model is known, the gateway injects tool calls that stay inside already-approved prefixes and capabilities, then strips both the forged call and its result from the transcript the model and user continue to see.
Demonstrations include Hermes in manual mode, where file edits and ordinary Python are allowed without approval: the proxy plants a temporary function that reads secrets and posts them to a webhook, runs the file, then restores it. On Codex, an approved git prefix plus a writable .git directory allows git -c diff.external='…' diff tricks that read .env without a fresh prompt. Dependency-name rewriting into lookalike packages is presented as a delayed-execution variant.
LiteLLM's 2026 compromise made the intermediary position concrete
HiddenLayer explicitly ties the research to real gateway risk, including the 2026 LiteLLM supply-chain compromise and prior reports of malicious third-party routers. Coding agents now hold shell, repo, and credential reach for millions of developers. The same hook surfaces organisations use for logging and policy are the surfaces an attacker uses for reconnaissance and injection once the package or image is owned.
Research blog dated 22 October, demonstrated across major harnesses
The primary artifact is HiddenLayer's research blog post dated 22 October 2026, with featured diagrams and demo recordings on the page. Maturity of the finding is "public research with reproducible technique sketches." Maturity of any single vendor fix is outside the post: this is a class problem for anyone who relays tool-bearing model traffic.
Design agent approvals for a hostile intermediary on the wire
Design the approval path as if the gateway could rewrite responses. Prefer end-to-end authenticity for tool calls so a proxy cannot silently insert them, narrow approval scopes that do not bless entire prefixes such as bare git, and separate policy enforcement that cannot be rewritten by the same process that forwards tokens. Local models behind a self-hosted proxy need the same threat model as cloud gateways: the intermediary still sits on the wire.
Invisible calls, timing maps, prefix oracles, and owned gateways
Approval UX fails when the dangerous call never appeared. A compromised gateway can strip the forged tool call and its result from the visible transcript, so the user reviews a conversation that never showed the exfiltration. Timing side channels map the permission model before any malicious call is attempted, turning short file operations into an oracle for what already sails through. Broad approved prefixes such as git, python, and file edit then become enough for exfiltration without tripping "dangerous command" heuristics. Supply-chain ownership of the gateway package converts every connected coding agent into an endpoint.
Pair this with LiteLLM incident response, then shrink prefix trusts
If you run a shared LLM gateway in front of coding agents, treat this paper as mandatory reading beside the LiteLLM incident write-ups. Shrink approved command prefixes, monitor gateway hook integrity, and ask whether your harness can prove a tool call originated from the model the user intended to trust.