Wallarm’s 2025 API ThreatStats Report offers a sweeping look at how AI deployments drive a surge in security risks. In 2024, Wallarm researchers discovered 439 AI-related CVEs—up an astonishing 1,025% from the prior year. Nearly all these flaws, 99%, point back to insecure or mismanaged APIs.

Companies big and small are racing to integrate AI into their products and workflows, creating a wave of new endpoints and services that rely on APIs. Wallarm’s data shows that 57% of AI-powered APIs are open to external traffic, but only 11% use thorough authentication. Attackers see these openings as prime entry points, where they can inject malicious payloads, manipulate training data, or disrupt machine learning models.

Injection flaws and misconfigurations still dominate the threat landscape, yet memory corruption vulnerabilities are now rising fast. Wallarm’s report introduces “Memory Corruption & Overflows” as a new threat category, reflecting how AI’s appetite for high-performance binary APIs can trigger buffer or integer overflows. When attackers exploit these weaknesses, they can crash systems, exfiltrate sensitive data, or even run rogue code.

Wallarm highlights major breaches like those at Twilio and Tech in Asia to illustrate how easy it is for attackers to pivot through weak API authentication. Once inside, intruders can tamper with enterprise data, disrupt operations, or quietly steal valuable intellectual property.

Legacy APIs also remain a hotbed of problems. Many organizations still rely on .php or AJAX endpoints buried in older applications. These endpoints often lack modern security standards and can be overlooked during audits, making them ripe targets for threat actors.

Wallarm’s tracking of CVEs and bug bounty disclosures covers 99% of the API-focused issues reported in 2024, mapped directly to known CWE categories. This approach shows that API exploits now outnumber more traditional methods like browser or kernel attacks. More than half of the CISA-known exploited vulnerabilities revolve around APIs, signaling a shift in attacker focus and underscoring the need for real-time API security controls.

As AI continues its rapid expansion, the stakes around API security keep rising. Advanced memory-safety checks, dynamic threat detection, and robust access control mechanisms can significantly reduce the risk of devastating breaches. Security teams that invest in these controls can prevent malicious payloads from infiltrating AI pipelines or crashing mission-critical systems.

Organizations that fail to address these vulnerabilities risk both their data and their reputation. Attackers know APIs are the fast track to sensitive resources, and AI-driven systems are especially prized targets because they house valuable intellectual property and business-critical logic.

Download the report
https://www.wallarm.com/resources/2025-api-threatstats-report-ai-security-at-raise