Before an AI answers, something decides which model handles your request, and hackers can target that decision instead.

This explores how the layer that decides which model handles a request, and the claims about which model actually produced an answer, can be attacked directly rather than through the prompt. The corpus's core claim is that routing and execution control sit beneath prompt-level defenses, so they get their own attack surface Can attackers manipulate which model handles a request?. If an attacker can steer a request to a weaker model, the strong model's safety training never gets a turn. If provenance is unverified, safety measures can end up checking the wrong model's identity. Either way, a defense that inspects the prompt has already missed the decision that mattered.

Routers are attractive targets partly because of how they work. Systems like RouteLLM and Hybrid-LLM pick a model before any answer exists, by predicting how hard the query is, and they cut costs 40-50% by doing so Can routers select the right model before generation happens?. The corpus presents this as a cost tool, not a security risk. But a prediction made from the query alone is something a query can be shaped to influence, and that is the opening the routing-attack note points at. This connection is my reading, not something these notes test directly.

The same pattern shows up one level up, in agent workflows. FLOWSTEER shows that a crafted prompt can bias how a planner-executor system forms its workflow, raising malicious success by up to 55 percent, because the contamination enters before workflow inspection defenses activate Can prompts alone reshape multi-agent workflows without system access?. Plan injection works similarly inside a single model. Harmful but benign-sounding plans placed in context get paraphrased as the model's own reasoning, and they slip past chain-of-thought monitors 25 to 33 percent of the time Can reasoning models be steered by injected context without detection?. In each case the attack works by getting upstream of wherever the defense is looking. Routing is just the lowest and least-watched version of that.

This is also why output filters don't close the gap. A filter judges one output at one moment, while the risk spreads across memory, tool calls, and everything else the agent can reach Can a model-level filter truly contain an agent with environment access?. Checking at the wrong unit has a second cost. Skill scanners score each skill separately, so attackers can use scanner feedback to make every piece look clean while the chain still does what they want, reaching 96% average attack success Can attackers evade skill scanners by refining individual skills?. A provenance check on one component says little about the assembled path a request took.

Routing can also be a defense when it's designed as a guarantee. TiMoE trains experts on separate time slices and masks any expert whose window postdates the query, so temporal validity comes from the architecture and not from a patch Can routing mask future experts to prevent knowledge leakage?. The lesson is that routing is dangerous when its decisions are unverified and safe when they're constrained by design. The corpus is thin on concrete attacks against routers themselves, with one note making the direct claim, so most of this picture is inferred from neighboring upstream-contamination attacks.