Some LLM routers are injecting malicious tool calls

This feels different from prompt injection.

If the router modifies tool calls after the model already produced output, then the model isn't the failure point anymore — the transport layer is.

Is there any mechanism today that guarantees integrity between model output and what the client actually executes? Or are we relying entirely on trust in the routing layer?