APIs, AI, and the Amplification of Security Risk

APIs, AI, and the Amplification of Security Risk

A10 Networks experts Jamison Utter and Carlo Alpuerto discuss how the rise of Agentic AI is dramatically scaling up existing API security problems, creating an "amplification effect" rather than introducing fundamentally new security challenges.

Jamison introduces the idea that AI, while using standard JSON APIs like OpenAI's ChatGPT, will generate a massive, unpredictable amount of internal and outbound API traffic. Carlo agrees, noting that this explosion exacerbates issues like API vulnerability management and the risk of Shadow APIs, which is especially true because an AI agent might learn to communicate with previously unused or deprecated "zombie" APIs, such as those associated with antiquated industrial control systems (like Windows 95 or ME systems).

The experts challenge the notion that URL/URI-based traffic monitoring is sufficient, arguing that most current tools cannot recognize and track this new, complex API exchange. They highlight the asymmetric nature of AI data exchange—a small text prompt can return a massive video file, making analysis difficult. Ultimately, they emphasize that a proactive, specialized approach is needed to identify, secure, and decommission APIs before they are exploited.

Key Discussion Points:
🔹 AI as an Amplifier: Agentic AI doesn't create new security problems, but dramatically worsens existing ones.
🔹 The API Explosion: The shift to Agentic AI will generate a massive, unpredictable volume of internal and outbound API traffic.
🔹 Shadow and Zombie APIs: AI agents may spontaneously find and use old, unsecured, or decommissioned APIs.
🔹 The Asymmetric Threat: Small, simple AI prompts can yield significant, complex data responses, complicating network analysis.
🔹 The Need for Awareness: Traditional security tools are often inadequate, failing to recognize API traffic beyond the URL/URI level.
🔹 Security Through Obscurity is Dead: AI can quickly discover the APIs of systems previously considered secure simply because they were obscure.

Learn more about API security and AI: https://bit.ly/48iZk2d

#api #apisecurity #aisecurity #agenticai #apiexchange