The API security problems we have now are not new. Broken object-level authorization–the flaw where your API happily hands over record 1002 to someone who was only ever supposed to see record 1001, because it checked that you were logged in but never checked that the record was yours–has topped the API security lists for years. We have known about it, written about it, and built entire tooling categories around it. What has changed is not the vulnerability. What has changed is who is knocking on the door, how fast, and how many times.
A human attacker exploiting a broken-authorization flaw has to work at human speed. They enumerate identifiers by hand, or script something clumsy, and there is friction and time and noise at every step. An agent has none of that friction. Point automation at an API with a broken object-level check and it will walk the entire keyspace–every record, every ID, every field you accidentally left reachable–faster than your monitoring can raise an eyebrow. The flaw that used to leak a handful of records to a determined human now drains the whole table before lunch. Same bug. Radically different blast radius.
I brought up Optus in my Nordic APIs conversation for a reason, because it is the concrete version of this abstract fear. In 2022, an exposed API with insufficient authorization controls leaked the personal data of millions of Optus customers. That breach did not require exotic tooling or a nation-state–it required an API that trusted the caller more than it should have, and a caller willing to iterate. Now imagine that same class of flaw in a world where iterating is the default behavior of every agent on the network, where automation is cheap, tireless, and everywhere. The Optus-shaped hole was bad enough at human speed. Agents are the speed multiplier we did not have in 2022.
And it is not only malicious actors you have to design for, which is the part teams keep underweighting. A perfectly well-intentioned agent, wired up by a perfectly well-intentioned developer, can hammer your API thousands of times a second, ignore the rate limits you thought were advisory, retry aggressively on errors, and blow straight past the access patterns your contract quietly assumed everyone would respect. It is not attacking you. It is just doing what it was told, at a scale no human integrator would ever have generated by hand. The faulty agent and the malicious one produce remarkably similar traffic, and your infrastructure has to survive both without being able to tell them apart in the moment.
This is the shift I want teams to internalize: the agentic world does not introduce a new category of API vulnerability so much as it removes the friction that was silently protecting you from the ones you already have. All those latent flaws–the missing authorization check, the endpoint that returns more fields than it should, the rate limit that was never really enforced, the contract you assumed people would honor–were survivable partly because exploiting them at scale was tedious. Agents delete the tedium. The security debt you have been carrying because “nobody’s actually going to sit there and enumerate all of it” just met something that will absolutely sit there and enumerate all of it, without getting bored.
So the defensive work is not glamorous and it is not new–it is the fundamentals, finally taken seriously because the cost of skipping them just went up. Check authorization at the object level, on every request, for every record, no exceptions. Return only the fields the caller is entitled to, never the convenient superset. Enforce rate limits as real limits, not polite suggestions, and assume every consumer is capable of machine-speed traffic whether or not they mean any harm. Treat your API contract as something that will be tested to its literal edges, because it will be. The agents are not going to be more careful than your weakest authorization check. They are going to find it, at speed, and the only thing standing between that and the next Optus headline is whether you did the boring work before they got there.
