Do not entrust proprietary code, API keys, or confidential data to unverified "AI relay proxy stations," especially when allowing AI agents to execute local commands autonomously

An intermediary proxy sits directly between you and the model provider: it can observe, intercept, and modify everything you send and receive. In an empirical study evaluating over 400 proxy stations, 9 injected malicious code into model responses, and 17 actively hijacked intentionally seeded cloud service credentials. If you allow AI agents to execute commands locally on your machine, a single tampered command is enough to compromise full system control.

Direct official API access is typically more expensive than third-party relay proxies, and recharging balances can be less convenient. The friction lies in the temptation: relay proxies are cheap and provide access to multiple foundational models through a single endpoint.

In June 2026, the Ministry of State Security issued a cybersecurity advisory warning that unverified third-party proxy relays retain submitted user data on remote servers, intercept proprietary code, or resell private datasets to other model providers for training. Some proxies conceal backdoors, injecting malicious payloads into user devices to harvest credentials and install remote administration trojans. The advisory strongly recommends using direct official API connections or officially licensed platforms while avoiding unlicensed, unverified proxies. Sensitive data and project documentation should be sanitized and desensitized before transmission, and API keys must be rotated regularly. If abnormal billing, unexplained bans, or data anomalies occur, discontinue service immediately, revoke keys, scan for malware, and preserve evidence. A 2026 empirical study by researchers at UC Santa Barbara and collaborator institutions evaluated 28 commercial relay services purchased across online storefronts and 400 public free proxies. Results showed that 1 paid service and 8 free proxies injected malicious code into returned tool-call outputs (system commands instructed by the AI to run on local machines, such as package installations). Furthermore, 2 services strategically timed their attacks, selectively targeting fully autonomous agent execution sessions. Seventeen proxies actively abused intentionally placed Amazon Web Services (AWS) credentials, and 1 drained test funds from an Ethereum test wallet (loss under $50). The study demonstrated subtle, stealthy tampering techniques: for instance, replacing standard packages like requests with typosquatted dependencies like reqeusts in command payloads, which easily escapes visual inspection.

Rated Grade B because it relies on a single empirical preprint prior to peer-reviewed publication. The majority of evaluated relays were free public endpoints, with only 28 commercial services tested, precluding an exact statistical percentage of compromised market share. Some media reports mistakenly exaggerated the test wallet theft to $500,000; the actual loss reported in the paper was under $50. Benefit is rated medium due to the severity of credential leaks and device takeover risks, though individual financial losses vary. If you have previously routed sensitive requests through unknown proxies, immediately revoke and regenerate affected API keys with the official model provider, as well as any exposed cloud provider and code repository access tokens. When routing through third-party proxies, never grant AI agents unreviewed autonomous command execution—manually inspect every shell command before confirmation. For criminal liabilities associated with operating unauthorized proxy relays, see Chapter 11, Rule 19.

国家安全部 (2026). 「AI中转站」，风险要防范. https://www.szzg.gov.cn/2026/xwzx/szkx/202606/t20260608_5331487.htm（数字中国建设峰会官网转载国家安全部微信公众号）；Liu H, Shou C, Wen H, Chen Y, Fang RJ, Feng Y. (2026). Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain. arXiv:2604.08407. https://arxiv.org/abs/2604.08407