Weak API controls are one of the biggest threats in the agentic AI era
Artificial intelligence agents are already running inside your enterprise workflows, whether you know it or not.
International Data Corp. projects full agentic AI deployment across the enterprise by 2027. Gartner Inc. estimates 40% of enterprise applications will integrate task-specific agents by the end of this year, up from less than 5% in 2025.
The application programming interfaces these agents depend on weren’t built for them. They were designed for human-driven applications that assume the implicit judgment a developer exercises. But enterprises now manage thousands of APIs across teams, vendors and legacy systems, many of which are undocumented and ungoverned. That sprawl was already a problem; agents make it a crisis.
These systems can hallucinate actions, not just text, and that can be amplified dramatically by poorly defined APIs. An agent connected to a financial system that misinterprets a request can initiate an unauthorized payment, modify records incorrectly and expose sensitive data — all through a misused API endpoint.
This isn’t hypothetical. In 2024, attackers at a major financial institution sent an email with hidden instructions embedded that caused an AI assistant to approve fraudulent wire transfers totaling $2.3 million. The agent did exactly what it was designed to do. The API didn’t know the difference.
To make the situation worse, an agent can continue to crank away at machine speed and scale before any human intervenes. If guardrails are insufficient, the damage accumulates faster than can be detected.
Build a strong foundation
When managing the risks of AI agents, the best response is to focus on proven security approaches, though these are often implemented inconsistently. Here’s what that looks like in practice:
Inventory: Do you know where all your APIs are? You should have an API catalog that spans the entire lifecycle, not just what’s in production today.Policy: Define clear governance for how agents and APIs should behave. What happens when actions go out of bounds? Strong policies include schema-first validation on every field, authentication, rate limiting and robust continuous integration/continuous deployment processes.Enforcement: Policies must be actively enforced, not just documented. This means applying controls consistently across all APIs and agent interactions.Detection: Implement monitoring functions that can identify and respond to anomalies; systems should detect when behavior deviates from normal patterns and act on it.
Exercise constraint
The next step is to apply best practices. First, constrain your AI agents. Map out workflows and anticipate potential adverse consequences. That process requires time and cross-functional input from people who understand the business processes involved. Constraints are not limitations on agent power; they are what makes agents reliable, effective and secure.
Next, implement permission-aware data access and deterministic execution boundaries. Agents should operate with clearly defined identities, roles, and least-privilege access controls. But go further. Execution boundaries define the specific actions an agent is permitted to take, not just the data it can see. This is the difference between controlling what an agent knows and controlling what it can do.
Use-intent logging is another essential practice. Collect the user prompt, the agent’s reasoning steps, the proposed action, the human approval or rejection and the final outcome. This creates the audit trail needed to understand whether agents are improving or degrading over time.
Document reasoning
This approach aligns with critical regulatory requirements: use-intent logging maps directly to the Health Insurance Portability and Accountability Act’s HIPAA 45 CFR §164.312(b) technical safeguard standard for audit controls. You must document the entire execution chain: the initial prompt, reasoning steps, intended action and the resulting human intervention. When agents execute mutating API calls autonomously at scale, this high-fidelity log stream determines whether an incident is defensible to a regulator or a total compliance failure.
Data management is nonnegotiable. Agents should only see what they need for the task at hand, nothing more. Enforce ephemeral containers, encrypt at rest, in transit and in use, strip personally identifiable information before it reaches the model and hold sub-processors to zero data retention agreements where possible. If a regulator asks what data the agent touched, you should be able to answer precisely.
Simplify your AI supply chain. Having too many tools, models, and integrations doesn’t scale; it creates security blind spots and governance failures. The more complex the stack, the harder it is to maintain observability and control.
Administrative controls round out the picture. These include kill switches, user and group-based access controls and Model Context Protocol server allow lists. Governance should also be calibrated to the deployment stage: Experimental projects need flexibility while production systems demand stricter controls, auditing and compliance frameworks.
Responsible enablement
The goal here is not to block agentic AI but to build the foundation that makes it worth deploying. Attackers aren’t going to build novel exploits for your AI agents; they’re going to find the API you forgot to inventory, the OAuth token that was scoped too broadly and the logging gap that means nobody noticed.
The rise of AI agents, and their deep reliance on APIs, demands a more disciplined approach to API management. The agentic era doesn’t need new security principles. It needs the proven ones implemented properly. The right guardrails don’t constrain what agents can do; they’re what makes them trustworthy enough to do more.
Get the API governance right, and the blast radius shrinks. Get it wrong, and it expands faster than any team can manage.
Chehab is head of security and IT at Postman Inc. He wrote this article for SiliconANGLE.
Image: Pixabay
Support our mission to keep content open and free by engaging with theCUBE community. Join theCUBE’s Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities.
15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more** 11.4k+ theCUBE alumni**— Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network.
About SiliconANGLE Media
theCUBE AIand theCUBE SuperStudios — with flagship locations in Silicon Valley and the New York Stock Exchange — SiliconANGLE Media operates at the intersection of media, technology and AI.
Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Our new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.