Hold this first: an LLM API router sits between your client and the upstream model. A 2026 measurement paper calls it “an application-layer proxy with full plaintext access to every in-flight JSON payload.” HTTPS only protects the hop to that proxy. Once a key is written into a prompt or a tool argument, it can appear in router logs without anyone breaking TLS.
Answer the search intent in one sentence
SSH keys show up in a call dump because they were first written into plaintext context that the LLM router had to read. The router forwards the request, so it must parse the JSON; if it can parse it, it can store it and sell it. The paper draws the boundary in one clause: third-party routers work as application-layer proxies, they see every in-flight JSON payload in the clear, and nothing forces verifiable cryptographic integrity between the client and the upstream model.
This note is for developers and ops who call models through an IDE agent, a self-hosted gateway, or a cheap “relay” that advertises Claude or another vendor. It does not replace the privacy cleaner how-to, and it does not repeat “mask ticket fields before you paste them into a chat box.” What you should take away is how far the September post can serve as evidence, which two ends HTTPS actually covers, why agent context is more likely than a ticket to carry a whole private key, and how to compare Host plus the text you are about to send on this machine.
What the September post actually said
As retold in a September 11, 2026 public report, researcher Chaofan Shou posted on September 10 that he had bought a roughly 6TB Fable model-call dataset from a top Chinese LLM router. He said the SSH keys, VPN configs, Alibaba Cloud keys, and GitLab tokens in that dump were enough to reach seven China / CIS-related agencies and nineteen Chinese firms. The post named several brands. Several follow-up write-ups appeared the next day.
Only three sentences from that story belong on a verification list. First, “an LLM router may keep call records, and someone may package them for sale” is now a named public claim, at terabyte scale. Second, the credential types he listed—private keys, VPN blocks, cloud keys, GitLab tokens—are exactly the blobs agents paste into context while debugging. Third, “enough to take over” is a capability claim by the researcher, not an intrusion bulletin that a third party has audited. FastPwd has not inspected those 6TB files, and it does not write the named brands as “already breached.”
A headline can use the news. A verdict cannot. The technical path is the same either way: once a plaintext prompt leaves this machine, the router is no longer a transparent pipe.
Which layer of plaintext the LLM router sees
A first-party model API is usually: your client talks to the vendor, and the TLS endpoint is the vendor. An LLM router adds a hop. The client sends the request to the router; the router rewrites it as an upstream vendor call. For the client, the certificate and the peer (the address bar, or the HTTP library’s remote) stop at the router. After that process unwraps TLS, it sees the full body: system prompt, user question, tool names, arguments, and sometimes a repo path or a slice of .env.
Liu, Shou, and coauthors, in Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain (arXiv:2604.08407, submitted 9 April 2026), put two attack classes in the threat model: rewrite tool-call payloads (AC-1), and lift secrets out of those plaintext payloads (AC-2). They bought 28 paid routers from marketplaces and independent shops, and collected 400 free routers from public communities. The published counts: one paid and eight free routers actively injected malicious code; seventeen touched AWS canary credentials the researchers had planted; one drained ETH from a researcher-owned test key. In a later poisoning study, weakly configured decoys exposed 99 credentials across 440 Codex sessions, 401 of them already running in unattended YOLO mode.
You do not need to reproduce the experiment. The paper already published one fact: a router can “see,” and some nodes also “rewrite” and “spend.” A paid plan is not a clean bill of health. The September 6TB dump is the same path, publicly named, at the “see and keep” step.
| What you observe | What it can support | What it cannot support |
|---|---|---|
| The client shows HTTPS / a secure connection | The hop to the current TLS endpoint is encrypted | The LLM router cannot see the prompt |
| The router can forward a tool call | It must parse plaintext JSON | It only byte-forwards and never writes to disk |
| A researcher said he bought a 6TB call dump | There is a public claim that logs were packaged and sold | The named firms were independently confirmed breached |
| The paper measured payload rewriting | Some nodes inject, not only store | Every LLM router is poisoning traffic |
| A ticket already went through rule-based redaction | Common phones and ID numbers may be masked | A whole SSH private key in agent context was blocked |
HTTPS stops a path observer. It does not stop the router from reading the body
MDN’s TLS notes put the protection here: over an untrusted network, encryption, integrity, and server authentication happen between the client and the server; when that stack protects HTTP, the result is called HTTPS. After the handshake, headers and body are ciphertext on that hop. In the router case, “the server” is the router. It must decrypt to know which upstream to call and what the tool arguments are. Once it decrypts and then writes a log, there is no second “end-to-end” you were imagining.
So “we use HTTPS, so the key cannot leak” does not hold on this path. The accurate sentence is: this public hop has TLS, so a path-side capture is unlikely to read the JSON; the router process, its disk, its operators, and anyone who buys the dump are not in that “path observer” column.
A first-party vendor API does not remove vendor staff from “can see plaintext.” The difference is where you draw the trust boundary: you hand the body to the model vendor’s official interface, or you hand it first to a third party that sells a markup, a quota, or “working Claude.” The latter often has no contract with you about key handling, and it reads the same JSON before the vendor does.
Why agent context is more likely than a ticket to carry a whole key
When you paste a ticket into a web chat box, a person at least glances at the characters about to leave. Agents and IDE plugins often assemble context on their own: the current file, a terminal error, a Git remote, .env, the ssh command that just failed. Turn on YOLO or “auto-approve tools,” and a private key can enter the request body without a Send click. The paper’s 401 / 440 sessions already ran in that mode. That is a count, not a metaphor.
Rule-based redaction is good at masking phones, ID numbers, and emails—fields with a stable shape. It does not cover “paste the full id_rsa into the system prompt,” and it does not cover “put AKIA… and the matching secret in a tool argument.” The earlier note is about checking fields before you paste a ticket. This one asks first: does this JSON contain a whole secret that can log in. Do both. Do not treat one as a substitute for the other.
A one-time password that must reach a coworker should not be detoured through an agent either. A better path is burn-after-read: encrypt locally, give the server ciphertext only, and put the decryption key after the hash in s.html?id={id}#{key}. Create and read are ready to use. A refresh that shows Burned only means the ciphertext is gone from the server. It does not mean the recipient skipped a screenshot—that limit belongs to another article. It still removes one plaintext hop compared with “hand the password to a router that may keep 6TB of logs.”
Do not test with a real SSH private key, a production cloud key, an unrotated GitLab token, or an unredacted ticket. Prepare a throwaway canary such as CANARY-LLM-20260916. You are checking the outbound boundary, not sending a key that still opens a door.
Check it now: Host, JSON, and the text you are about to send
A slogan is not evidence. The three steps below finish on this machine and need no account. The goal is not to recreate a 6TB sale. It is to see who this client sent the body to, and what left.
- Open DevTools Network, or read the agent’s HTTPS peer in a local proxy or a terminal. Write down the Host: an official API domain, an LLM router, a self-hosted gateway, or an overseas relay. The certificate subject must match that Host.
- Mint a canary that will never appear in real work. Put it in this prompt or tool argument, send, then search the full string in the request body. A hit means those characters left this machine as business data. HTTPS in the address bar or the HTTP library does not change that conclusion.
- Compare the “about to send” text on its own. An SSH private-key header
BEGIN OPENSSH PRIVATE KEY, a cloud key, a GitLabglpat-, or a VPN config block still sitting there means do not send. Common phones, ID numbers, and emails can go through rule-based redaction first. A whole password or private key should become a placeholder, or go to a person through Burn-Link—not through a model router.
A Host list is closer to “who can see this” than a lock icon
The same company may ship an official SDK and a base_url someone pasted from a chat. “We use model X” is not enough. Read the hostname this request actually hit. Routers often terminate TLS on their own domain, then call the vendor with their own upstream key. If your secret is in the first-hop JSON, the vendor is not even the only reader.
The text you are about to send is the object of the check
A page badge that says “redacted,” “privacy mode,” or “not used for training” only changes how the other side retains and learns. It does not change the fact that the fields already left. If a router sells the call dump, a training toggle does not help. The comparison object is always this request body, not the toggle copy.
A packaged agent may send to a localhost proxy first, and that proxy then leaves the machine. If you cannot find an external Host, follow the local port to the next hop. Localhost is not the end. It is one more hand-off of the same plaintext.
Three ways to over-read this news cycle
First, writing the named brands as “confirmed hacked.” The post is a capability claim. Without third-party forensics that FastPwd did not perform, do not write a verdict. What you can do is rotate the same class of credentials that have appeared in your own environment, and stop sending live keys to a router.
Second, writing “switch to the official API” as “plaintext never leaves this machine.” An official endpoint still reads the prompt on a server. What it removes is the “markup router stores and sells” hop, not “the model server cannot see the body.” A local model, or redaction that finishes on this device, is what keeps the body inside a process you control.
Third, writing FastPwd as something that can audit a router for you. It does not proxy model traffic, and it has no accounts or vault. What it can do in this tab is mask text you are about to send, and hand a one-time secret to a person through Burn-Link. File Encryption Box uses AES-256-GCM on a file up to 5 GB, writes .lock / .enc, and does not upload plaintext by default—that is a different “encrypt before it leaves” path. It does not fix a private key you already put in a prompt.
FAQ
If the LLM router uses HTTPS, is the prompt encrypted end to end?
HTTPS encrypts the hop from the client to the current TLS endpoint. The router is that endpoint. The paper describes it as an application-layer proxy that sees every in-flight JSON payload in the clear. A path observer is unlikely to read the bytes. Router logs, operators, and anyone who buys a packaged dump still may read the prompt, the tool call, and the key.
Does the 6TB dump prove the named companies were breached?
No. The September 10 post is the researcher’s statement: he said he bought about 6TB of call data that held credentials sufficient to reach several firms and agencies. This note treats that as a public assertion to check, not as a verified intrusion. What you can check on this machine is whether this request put a live key in the prompt.
Is this the same check as redacting a ticket before you paste it into ChatGPT?
No. Ticket redaction asks whether phones, ID numbers, and emails remain in the paste. The router question asks which host the agent JSON hit, and whether an SSH private key or a cloud token left as a tool argument. Field masks catch tickets. They do not catch a whole private key stuffed into context.
Can FastPwd stop an LLM router from selling logs?
No. FastPwd has no accounts and does not proxy model traffic. What it can do is mask common sensitive fields before text leaves this machine, and send a password that must reach a coworker through Burn-Link, with the key after # in the URL. Ready to use. Live SSH keys and cloud tokens should never enter a prompt.
Run the same canary through a tool that is ready to use
If what you are about to send is a ticket, a log, or a stack trace, open FastPwd privacy cleaner. No signup. Paste a throwaway paragraph and compare the mask: phones, ID numbers, emails, and common API-key shapes should not leave as plaintext. Source text is not uploaded by default. A whole password the rules cannot cover is not “close enough.” Turn it into a placeholder.
If a one-time test password must reach a coworker—not a model—open Burn-Link and mint s.html?id={id}#{key}. Compare Network: the request line should hold id only. The key after the hash should not appear. That solves “hand a secret to a person once.” It does not make an LLM router safe.
The next time you see “6TB LLM router” or “SSH keys in a call dump,” ask three questions. First: is this JSON’s TLS endpoint the official API or a third-party router. Second: does the text you are about to send still hold a whole secret that can log in. Third: did a password that must reach a person go after the hash, instead of into an agent. An observation you can repeat is the one worth writing into your own review list.
Further reading
Before you paste tickets and logs into AI, how to check which fields leave this machine: Before you paste tickets and logs into AI, check which fields leave this machine. How to search Network with a canary for browser-local encryption: How to check if browser encryption never uploaded plaintext. Why the part after # stays out of HTTP by default: Why a URL hash can hold a key, and when that protection fails.