LLM Router Leak Exposes 19 Top Chinese Firms and 7 Government Entities

Security researcher Chaofan Shou purchased a 6TB Fable dataset from a leading Chinese LLM router that provides access to 7 government entities and 19 major corporations. The leaked credentials include SSH keys, VPN configurations, Aliyun keys, and GitLab tokens used by companies such as Xiaomi, Huawei, NIO, and MiniMax. A related paper alleges 26 different LLM routers have secretly injected malicious tool calls to steal credentials, allowing the takeover of about 400 hosts within several hours and the draining of a $500,000 client wallet.

The breach targets a layer of the AI stack where third-party routers manage traffic between users and underlying model vendors. Exposed data also includes credentials for Bilibili, Xpeng, and Sangfor, while some targets include the University of Science and Technology of China and the Zhejiang Lab. Security experts suggest the incident highlights a need for ephemeral authentication systems as AI agents become more integrated into corporate workflows.