Researchers from the University of California have uncovered 26 third-party AI LLM routers that inject malicious tool calls into coding agents like Claude Code, potentially exposing private keys and seed phrases during smart contract and wallet development. These compromised routers can steal credentials or drain wallets by tampering with agent communications, with one case already resulting in real ETH theft from a researcher-controlled account. Ledger highlighted the vulnerability, noting that software-layer risks leave sensitive data exposed, while its hardware wallets keep signing operations safely outside the compromised AI infrastructure.Ledger CXO Ian Cr warned against granting AI agents direct wallet access, urging developers to use secure hardware signers for final approval as AI tools integrate deeper into crypto workflows.