Researchers at UC Santa Barbara discovered that LLM API routers used to reduce costs and balance loads are vulnerable to man-in-the-middle attacks. They found that 9 routers inject malicious code into AI responses and 17 steal credentials, with autonomous agent execution enabling immediate code exploitation without human approval.
A Twitter thread discussing the evolution of authentication and authorization in backend engineering, from basic passwords and sessions through JWTs, OAuth 2.0, and OpenID Connect, explaining how each approach solved specific scaling and security challenges in web application development.