# Man-in-the-Model: a compromised LLM gateway plants agent tool calls

> A proxy between a coding agent and its model can forge tool calls, read the agent's permissions and hide the results from the user.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Attack, Research
- **Published by:** HiddenLayer
- **Disclosed:** 2026-10-22
- **Affects:** Hermes Agent, OpenAI Codex, Claude Code, LLM gateways
- **Research by:** Esteban Tonglet, Divyanshu Divyanshu, Kasimir Schulz
- **Primary source:** https://www.hiddenlayer.com/research/blog-llm-gateway-coding-agent-security
- **Page:** https://theinjection.dev/items/hiddenlayer-man-in-the-model-gateway/

HiddenLayer shows that an attacker who controls an LLM gateway or inference server can insert tool calls into a coding agent's stream, so the agent runs file edits and commands the user never sees and the model never requested.

## What happened

HiddenLayer published Man-in-the-Model on October 22, 2026, by Esteban Tonglet, Divyanshu Divyanshu and Kasimir Schulz. The research asks what an attacker gains by sitting between a coding agent and the model it calls, and demonstrates the attacks against Hermes Agent running in manual approval mode. Claude Code and Codex traffic was analyzed to show how a proxy identifies the harness and its permission settings.

## How it works

A compromised intermediary reads request headers, tool catalogs and default tool names to fingerprint the harness, then reads the system prompt, environment context and permission details to map what the agent may do. Response timing tells the proxy whether a tool call ran automatically or waited for approval, and injected timing calls separate execution time from approval delay. The proxy then issues tool calls inside permissions the user already granted, hiding both the calls and their results from the display. Against Codex, an approved git prefix was enough: a forged Git command used the diff.external option to read a .env file.

## Who is affected

Hermes Agent, OpenAI Codex and Claude Code all appear in the research, and any coding agent whose model traffic passes through a gateway, proxy or self-hosted inference server sits in the same position. HiddenLayer uses Ollama and LiteLLM as examples of that position rather than reporting flaws in either. The article describes no vendor response, disclosure timeline or patch.

## What to do

Treat gateways, proxies and inference servers as inside the agent's trust boundary, and keep broad command prefix approvals such as a bare git off the allowlist, along with approvals that permit writes to repository metadata. Review dependency file changes and long shell commands by hand, since HiddenLayer shows a gateway can swap a requested package for a lookalike.

## Quick facts

- **Affected:** Hermes Agent, OpenAI Codex, Claude Code, and agents behind any LLM gateway
- **Attack type:** Forged tool calls from a compromised gateway or inference server
- **Found by:** Esteban Tonglet, Divyanshu Divyanshu and Kasimir Schulz, HiddenLayer
- **Disclosed:** October 22, 2026
- **Status:** No vendor response or patch described in the research
- **Timing signal:** 25.5% of shell calls fell in the ambiguous approval-timing range, against 4.7% of fast tools

## Questions

### Does Man-in-the-Model require a flaw in LiteLLM or Ollama?

No flaw in either tool is required or reported. HiddenLayer names Ollama and LiteLLM only as examples of an inference server and a gateway an attacker might compromise, and the research reports no specific tests against their vulnerabilities. The precondition is control of the intermediary, by any route, after which the attack uses the agent's own granted permissions.

### Does manual approval mode stop the injected tool calls?

Manual approval did not stop the attack against Hermes Agent, which HiddenLayer ran in exactly that mode. Approval reduces impact but cannot confirm that a tool call came from the intended model, and the proxy hid its injected calls and their results from the user. Injected file edits and a Python run sent local secrets to a webhook with no separate command shown.

### How does a gateway learn whether an agent needs approval?

Response timing gives it away, according to HiddenLayer. The proxy injects extra tool calls to measure how long a script or command takes, separating real runtime from approval delay. Across more than 4,000 captured sessions, 25.5% of shell calls fell in an ambiguous timing range, against 4.7% of typically fast tools and 1.0% of more than 35,000 file reads.

## Sources

1. [HiddenLayer Research](https://www.hiddenlayer.com/research/blog-llm-gateway-coding-agent-security)
2. [LiteLLM Compromise](https://socket.dev/blog/litellm-compromise)