9Router: 26k Stars, 4 Unpatched CVEs, and Your API Keys in the Clear

A free AI router promises to save you $200/month. The price: nine security advisories in seven months, four unpatched criticals, and a headline feature Anthropic bans and suspends accounts for.

A free AI router that saves you $200 a month is not free if it leaks every API key you own. 9Router — 26,096 stars on GitHub, MIT licensed, installed with one npm command — has accumulated nine published security advisories in seven months, four of them rated critical, and several with no patch available as of today. On top of that, its headline feature (routing Claude Code and Codex through your consumer subscription) is exactly the behaviour Anthropic banned and started suspending accounts for in early 2026.

I spent a day evaluating 9Router and its cousin codex-lb for use inside my own agency. This is what I found, and why one of them is a hard no while the other is a narrow maybe.

What is an "AI router" and why is everyone installing one?

The pitch is genuinely appealing. You already pay for Claude Pro, ChatGPT Plus, and maybe GitHub Copilot. Each one hits a rate limit at the worst possible moment. Each one leaves unused quota on the table at the end of the month.

An AI router sits between your coding tool and every provider you have access to. It exposes one OpenAI-compatible endpoint on localhost, and when one provider runs dry it silently fails over to the next. 9Router markets this as a 3-tier fallback:

It also ships RTK Token Saver, which compresses tool output — git diff, grep, directory listings — before it enters the model's context. The project claims 20–40% input token savings (the homepage says 20–65% with a second compressor called Caveman). That is a genuinely good idea, and nobody outside the project has independently measured it.

9Router itself costs nothing. There is no hosted version and no paid tier. That is not a feature. It is a question with no published answer.

The security record: nine advisories in seven months

The repository was created on 5 January 2026. Querying the GitHub Advisory Database for the npm package 9router on 23 August 2026 returns nine entries:

Separately, Pentest-Tools documented that 9Router accepts the default password 123456 when none has been set, issuing a real 24-hour session — including to remote logins.

Read that table again with one fact in mind: this is the piece of software holding every OAuth token and API key you own, in a local SQLite file. Five of those advisories let an unauthenticated stranger read or overwrite that file, and one gives them arbitrary command execution as your user.

The counterargument is "it only listens on localhost." Two of the advisories are specifically about that gate being bypassable, and there are popular tutorials showing people deploying 9Router to a VPS and to Hugging Face Spaces. The localhost assumption does not survive contact with how the tool is actually used.

The feature that gets your account banned

Tier 1 — the reason most people install a router at all — is the part the vendors have already closed.

On 20 February 2026, Anthropic updated its compliance page to state plainly: "Using OAuth tokens obtained through Claude Free, Pro, or Max accounts in any other product, tool, or service — including the Agent SDK — is not permitted and constitutes a violation of the Consumer Terms of Service." This was not a new rule; it was a clarification of Section 3.7, backed by enforcement. Anthropic engineer Thariq Shihipar confirmed in January 2026 that the company had begun blocking third-party tools from spoofing the Claude Code harness. Accounts were banned. OpenCode removed Claude support citing legal requests.

On the OpenAI side the picture is messier but not friendlier: the OpenAI developer forum carries reports of ChatGPT Pro accounts suspended with no warning and no explanation, including one from an 18-month subscriber. The commonly cited risk signals are automation on a consumer plan, datacenter or shared IPs, and payment method changes.

9Router's README contains zero ToS warnings. Its GitHub description reads "Unlimited FREE AI coding… never hit limits." Its homepage advertises a feature called "MITM Bridge — IDE Subscription Intercept" that intercepts Antigravity, GitHub Copilot, and Kiro IDE traffic so those IDE subscriptions can call any backend — followed by a small parenthetical: "mind each tool's policy." The project knows exactly what it is doing.

"Free forever" has a shelf life

The free tier is the most fragile part of the stack, and the project's own documentation proves it: iFlow, Qwen Code, and Gemini CLI free tiers were discontinued during 2026 — while the homepage still lists iFlow and Qwen under "FREE Forever." Kiro gives roughly 50 credits a month. OpenCode Free's model list changes without notice. Vertex's $300 is a 90-day new-account credit.

If you are a hobbyist, a free tier evaporating mid-month is an annoyance. If you have committed to a client that content ships every week, a compute source that can vanish without notice is not a compute source at all.

codex-lb: the same idea, done more honestly

codex-lb (2,843 stars, MIT, last commit 22 August 2026) does one narrow thing: it pools multiple ChatGPT accounts you own, round-robins requests across them, and tracks tokens and cost per account over a 28-day window, behind a dashboard with password and optional TOTP.

The difference matters. It does not spoof a first-party harness. It does not intercept another vendor's IDE. It has zero published security advisories — though zero advisories means "nobody has audited it," not "it is safe." OpenAI's terms prohibit sharing credentials with other people; two subscriptions you pay for yourself, used by yourself, is a different situation from one account split across a team. Automation on a consumer plan is still a documented ban signal.

The genuinely useful thing here is not the failover. It is the per-account cost tracking — knowing which project burned which tokens. That is a real gap in most teams, and it is worth more than the rate-limit dodging.

Four rules I now apply

1. A tool that holds your credentials is held to a higher standard than a tool that generates images. The blast radius of a compromised router is every provider account you have connected. Judge it like you would judge a password manager, not like a productivity app.

2. Steal the idea, not the binary. The two valuable insights in 9Router — that GLM and MiniMax are 10–50× cheaper for grunt work like translation, tagging, and QC, and that compressing tool output saves real tokens — cost you nothing to implement yourself. Buy the API keys directly, wire them into your own pipeline, and skip the middleman that holds everything.

3. If it needs a consumer OAuth token to work, it does not work. Commercial API keys have terms written for automation. Subscription tokens do not, and both major vendors have now said so in writing and enforced it with bans.

4. Never point a client at it. My agency's clients are restaurant and salon owners. They do not read CVE feeds, and localhost:20128 exposed on a shop Wi-Fi means nothing to them. Recommending a tool they must install, configure, and patch themselves is also the exact framing a done-for-you service sells against.

Should you use it?

9Router: no. Not until the unpatched criticals are fixed and someone independent verifies it. The savings are real but small; the downside is every API key you own plus a possible ban on the accounts you actually depend on.

codex-lb: narrowly, yes — local only, never exposed to the internet, only with accounts you pay for yourself, and mainly for the cost reporting rather than the failover. If you need real production routing, use a gateway with commercial terms and commercial API keys.

The uncomfortable truth about "free AI" tooling in 2026 is that the money has to come from somewhere. Sometimes it is a venture subsidy. Sometimes it is a free tier that ends in March. And sometimes it is you, absorbing a risk the project never priced.

FAQ

Is 9Router safe to use? Not currently. Nine security advisories were published between April and August 2026, four rated critical, and several — including full credential theft (CVE-2026-55500) and an unauthenticated API key leak — have no patched version listed as of 23 August 2026.

Does using an AI router get your Claude account banned? Using Claude Free, Pro, or Max OAuth tokens in any third-party tool violates Anthropic's Consumer Terms of Service, stated explicitly on 20 February 2026. Anthropic has banned accounts and technically blocked third-party harnesses from spoofing Claude Code.

Is codex-lb safer than 9Router? It has no published advisories and a narrower scope — pooling ChatGPT accounts you own rather than spoofing first-party clients. That is better, not proven safe. Run it locally, never expose it publicly.

Does RTK Token Saver really cut costs 20–40%? That is the project's own claim. No independent benchmark exists. The underlying idea — compressing git diff and directory listings before they enter context — is sound and you can implement it yourself.

What should I use instead? Buy commercial API keys from cheap providers directly (GLM, MiniMax) and route them through your own pipeline, or use a gateway with clear commercial terms. You keep the savings and drop the credential-theft and ban risk.

Sources: 9router.com · github.com/decolua/9router · github.com/Soju06/codex-lb · GitHub Advisory Database · CVE-2026-46339 · CVE-2026-62327 (IONIX) · 9Router default login (Pentest-Tools) · The Register, 20 Feb 2026 — Anthropic clarifies third-party ban · OpenAI Developer Community — Codex account ban report

#AISecurity #DevTools #ClaudeCode #Codex #OpenSource #CVE #APIKeys #TechStrategy

✍️ The Author: Do Ngoc Hoan Founder of CookConnects.ca & Wizy.ca. Bridging the gap between advanced algorithms and business execution. I write for technical founders looking to scale their impact with AI and robust engineering.

← Blog