Man-in-the-Model: a compromised LLM gateway plants agent tool calls

01What happened

HiddenLayer published Man-in-the-Model on October 22, 2026, by Esteban Tonglet, Divyanshu Divyanshu and Kasimir Schulz. The research asks what an attacker gains by sitting between a coding agent and the model it calls, and demonstrates the attacks against Hermes Agent running in manual approval mode. Claude Code and Codex traffic was analyzed to show how a proxy identifies the harness and its permission settings.

02How it works

A compromised intermediary reads request headers, tool catalogs and default tool names to fingerprint the harness, then reads the system prompt, environment context and permission details to map what the agent may do. Response timing tells the proxy whether a tool call ran automatically or waited for approval, and injected timing calls separate execution time from approval delay. The proxy then issues tool calls inside permissions the user already granted, hiding both the calls and their results from the display. Against Codex, an approved git prefix was enough: a forged Git command used the diff.external option to read a .env file.

03Who is affected

Hermes Agent, OpenAI Codex and Claude Code all appear in the research, and any coding agent whose model traffic passes through a gateway, proxy or self-hosted inference server sits in the same position. HiddenLayer uses Ollama and LiteLLM as examples of that position rather than reporting flaws in either. The article describes no vendor response, disclosure timeline or patch.

04What to do

Treat gateways, proxies and inference servers as inside the agent's trust boundary, and keep broad command prefix approvals such as a bare git off the allowlist, along with approvals that permit writes to repository metadata. Review dependency file changes and long shell commands by hand, since HiddenLayer shows a gateway can swap a requested package for a lookalike.

Questions people ask

Does Man-in-the-Model require a flaw in LiteLLM or Ollama?

No flaw in either tool is required or reported. HiddenLayer names Ollama and LiteLLM only as examples of an inference server and a gateway an attacker might compromise, and the research reports no specific tests against their vulnerabilities. The precondition is control of the intermediary, by any route, after which the attack uses the agent's own granted permissions.

Does manual approval mode stop the injected tool calls?

Manual approval did not stop the attack against Hermes Agent, which HiddenLayer ran in exactly that mode. Approval reduces impact but cannot confirm that a tool call came from the intended model, and the proxy hid its injected calls and their results from the user. Injected file edits and a Python run sent local secrets to a webhook with no separate command shown.

How does a gateway learn whether an agent needs approval?

Response timing gives it away, according to HiddenLayer. The proxy injects extra tool calls to measure how long a script or command takes, separating real runtime from approval delay. Across more than 4,000 captured sessions, 25.5% of shell calls fell in an ambiguous timing range, against 4.7% of typically fast tools and 1.0% of more than 35,000 file reads.

Sources 2 links, all fetched

1. 1hiddenlayer.comHiddenLayer Research
2. 2socket.devLiteLLM Compromise