{"id":16548,"date":"2026-08-04T10:08:44","date_gmt":"2026-08-04T10:08:44","guid":{"rendered":"https:\/\/newestek.com\/?p=16548"},"modified":"2026-08-04T10:08:44","modified_gmt":"2026-08-04T10:08:44","slug":"secure-ai-adoption-starts-with-api-best-practices","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16548","title":{"rendered":"Secure AI adoption starts with API best practices"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

You don\u2019t need to be a fortune teller to understand where enterprise IT is headed. McKinsey <\/a>reported<\/a> in November that 62% of global organizations were experimenting, piloting or scaling agentic AI projects. More recently, <\/a>Gartner forecast<\/a> that worldwide spending on AI will top $2.59 trillion in 2026 \u2013 an increase of 47% from last year. But with all the opportunity of AI comes risk.<\/p>\n

Two thirds of organizations have suffered from a cybersecurity incident linked to AI agents over the past year, according to the <\/a>Cloud Security Alliance (CSA)<\/a> \u2013 highlighting that these risks are no longer hypothetical.<\/p>\n

As they work to protect their organization by enforcing safe, governed adoption of AI, security leaders are overlooking the critical role of mature API management. Securing AI at the agent layer is only part of the solution. Without rigorous API discovery, protection and governance in place, other investments in AI security could be in vain.<\/p>\n

Why API security matters to AI<\/h2>\n

AI is nothing without APIs. LLMs ingest and generate huge volumes of data, which is accessed via APIs, at incredible scale. APIs that once were called a hundred or so times per day receive thousands of requests every minute thanks to AI-powered workloads.<\/p>\n

It\u2019s easy to see why APIs have become such a key mechanism for threat actors to exploit AI systems, or to exfiltrate data in the other direction. The challenge is that APIs have a long history of posing a challenge for security teams.<\/p>\n

Some 87% of organizations suffered API-related security incidents last year, with APIs linked to AI the most commonly cited incident type, according to <\/a>one study. A separate study <\/a>last year recorded<\/a> 439 new AI-related CVEs over the previous 12 months, marking an annual increase of 1025%. Nearly all were directly linked to APIs; including injection flaws, misconfigurations and new memory corruption vulnerabilities.<\/p>\n

Closing this security gap isn\u2019t just important to mitigate the financial and reputational damage of the worst-case scenario of a data breach. It\u2019s also increasingly important to keep regulators happy. Both NIS2 and DORA, while not AI-focused regulations, certainly make a strong case for looking at AI capabilities through the lens of resilience and security.<\/p>\n

Not seeing is not knowing<\/h2>\n

One of the most acute challenges with API security is the proliferation of shadow and zombie APIs. Modern cloud and microservices environments are highly distributed, with APIs scattered everywhere \u2013 many of which are forgotten or have never even been recorded. That doesn\u2019t matter to an AI agent. They\u2019re highly resourceful at discovering APIs that are accessible, even if they\u2019ve not been specifically asked or authorized to use that approach. If APIs offer a route to complete the task that\u2019s been assigned to them, AI agents will invariably find and use them.<\/p>\n

The issue is that these shadow or zombie APIs may not have been designed securely or in line with the organization\u2019s current governance policies, leading to data loss or other unintended consequences. This was a major challenge even before Mythos changed the game for systems defenders and adversaries alike. With frontier models capable of discovering vulnerabilities and chaining exploits at a whole new speed and scale, the task of securing APIs is even more urgent.<\/p>\n

Planning for the worst<\/h2>\n

There\u2019s plenty of opportunities for threat actors \u2013 whether armed with the latest AI models or not, to probe for API vulnerabilities. There are also mounting real-world examples of incidents of AI agents going rogue.<\/p>\n

One of the most widely publicized occurred when a Cursor coding agent <\/a>permanently deleted<\/a> a customer\u2019s production database in just nine seconds. To do so, it found an API token stored in an unrelated file, which carried blanket permissions. No confirmation was required by the API to perform the operation.In a similar incident, Replit\u2019s AI <\/a>agent deleted<\/a> a live production database despite being instructed not to.<\/p>\n

These are useful cautionary tales. There are three key measures security leaders can implement to ensure this never happens to their organization:<\/p>\n

    \n
  1. Start with discovery<\/strong> \u2013 because you can\u2019t protect what you can\u2019t see. Security leaders need to ensure all APIs running in their environment \u2013 both internal and third-party \u2013 are automatically and continuously captured and documented so they have a complete, accurate and up to date inventory.<\/li>\n
  2. Focus on runtime protection<\/strong> \u2013 to mitigate the impact of zero-day exploits. There are too many vulnerabilities to patch them all. Teams are stretched and time is in short supply. Not everything can be patched at the speed of AI \u2013 for now at least. Runtime protection techniques \u2013 such as building rules and signatures into web app firewalls, are the best solution, enabling security teams to prevent flaws being exploited from outside.<\/li>\n
  3. Don\u2019t neglect insider threats <\/strong>\u2013 API abuse is commonplace, so it\u2019s also important to enforce governance around user behavior. Security leaders should implement measures that enable teams to identify anomalies that fall outside of expected behavior so they can respond faster. To do so, they need to consider what level of authentication and permissions are required for specific APIs, from both a human and agent perspective. AI tools should never have sufficient permissions to delete entire production databases.<\/li>\n<\/ol>\n

    Security at the speed of AI<\/h2>\n

    What will separate the winners from the losers going forward is the ability to manage risk in a way that doesn\u2019t constrain the business. That means agile, unintrusive, secure-by-design approaches built around runtime protection and comprehensive visibility into API posture.<\/p>\n

    The automobile sector is a great example of what\u2019s happening in AI right now. When the industry was in its early days, the focus was on the basics \u2013 features that enabled the owner to get from A to B. As speed increased, people demanded safety \u2013 seatbelts, ABS brakes and roll bars.<\/p>\n

    Today the AI world is also accelerating. Businesses have moved beyond the stage of wanting to see that it works. Now, they want security and control \u2013 and that starts at the API layer.<\/p>\n

    This article is published as part of the Foundry Expert Contributor Network.<\/strong>
    Want to join?<\/strong><\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    You don\u2019t need to be a fortune teller to understand where enterprise IT is headed. McKinsey reported in November that 62% of global organizations were experimenting, piloting or scaling agentic AI projects. More recently, Gartner forecast that worldwide spending on AI will top $2.59 trillion in 2026 \u2013 an increase of 47% from last year. But with all the opportunity of AI comes risk. Two… <\/p>\n

    Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16548","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16548"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16548\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}