An API built to be safely called by a human through a reviewed frontend can become dangerous the moment the caller is an autonomous agent deciding, on its own, which endpoints to hit and in what sequence. A human engineer testing a refund endpoint calls it once, checks the response, and moves on with normal, predictable pacing. An AI agent working through a multi-step task can call the same endpoint hundreds of times in a minute, chain a read endpoint's output directly into a write endpoint's input without a human ever reviewing the intermediate step, and — critically — can be manipulated into taking an action a human caller never would, because the agent's decision about which API call to make next is itself influenced by untrusted content it reads along the way.
This lesson is not about a new category of API vulnerability — every control from BOLA prevention through rate limiting through input validation still applies unchanged. It is about a new category of caller whose behavior breaks two assumptions those controls were built on: that a request's volume and pacing look roughly human, and that the party deciding what to request next is the same trusted actor who authenticated in the first place. An agent acting on a user's behalf, but steered by content the agent read from an untrusted source, is a caller wearing legitimate credentials while taking direction from someone who never authenticated at all.
Analogy🏏Cricket
🏏 Think of it like cricket: A team's analyst, briefing the head coach before a series, is trusted with genuinely privileged access — full opposition scouting reports, the squad's own fitness data, tactical plans nobody outside the camp should see. A human analyst reads a report, applies judgment about what's actually relevant, and briefs the coach with that judgment already built in. Now imagine the board experiments with an automated briefing tool that pulls from the same privileged sources but acts on whatever text it encounters, unfiltered — including a doctored scouting document, planted by a rival team's staff, containing a fabricated note claiming a key bowler has been cleared to bowl an extra spell despite a workload-management flag that should have stopped it. A human analyst reading that same planted note would recognize it contradicts the medical team's actual records and flag it as suspicious before repeating it to anyone. An automated tool with the same access but none of that contextual judgment might act on the planted instruction directly, updating the official workload plan because the text told it to, using entirely legitimate access to make an entirely illegitimate change. Just as the automated briefing tool's privileged access becomes dangerous specifically because it acts on untrusted content without a human's contextual judgment in the loop, an AI agent's API access becomes dangerous specifically because it can be steered by untrusted content without the human's judgment that normally sits between reading something and acting on it. Just as the fix is not revoking the analyst's or the tool's access but adding a verification step between reading a claim and acting on it, the fix for an agent is not revoking its API access but constraining what it can do based on content alone. The insight is that access controls built for a human who applies judgment before acting do not automatically transfer their safety guarantee to an automated caller that reads the same content but skips the judgment step entirely.
🏏 Showing the Cricket analogy — a Cricket version isn’t available for this concept yet.