Ex-Hacker Warns of 'Vibe-Coded' APIs Riddled with Vulnerabilities
A former hacker turned cybersecurity CEO highlights the growing insecurity of APIs, attributing it to rapid, AI-assisted development and a lack of secure design principles.
Application programming interfaces (APIs) are increasingly becoming a significant attack vector into corporate networks, according to Alissa Knight, a former hacker now CEO of cybersecurity firm Assail. Knight stated in a recent interview that APIs, which are essential for modern IT infrastructure and facilitate seamless data exchange, are becoming less secure. This trend poses a growing risk of exploitation for organizations relying heavily on these interfaces for their operations.
APIs are described as the "plumbing of our world today," connecting critical systems in financial services, fintech, and even automotive sectors. Despite their ubiquitous nature and essential role in agile IT environments, Knight warns that they are also becoming the industry's Achilles' Heel due to a proliferation of software vulnerabilities. She attributes this decline in security to APIs being "vibe coded" by AI agents, rushed into production within days or hours, and often developed without adherence to "shift left" or "secure by design" principles.
Knight demonstrated her company's agentic AI swarm technology at a recent cybersecurity conference. The swarm successfully identified, chained, and exploited vulnerabilities in a synthetic environment designed to mimic a satellite ground station with an API similar to those used for managing satellite constellations. This demonstration, using open-source software from NASA's Jet Propulsion Lab for visualization, aimed to illustrate the potential consequences of such flaws in a controlled setting.
The vulnerabilities uncovered by Knight's AI swarm were primarily Broken Object Level Authorization (BOLA) flaws, which she notes account for up to 98% of the vulnerabilities she discovers in real-world engagements. "We do a really good job at authenticating, and we do a really terrible job at authorization," Knight explained, highlighting a common gap in API security.
In the demonstration, a "bearer token" issued after a user logged into a dashboard, which should have been scoped for a single satellite, was exploited. Due to the BOLA vulnerability, the token allowed Knight's AI swarm to gain full command access to any satellite in the constellation, not just the one it was scoped for. This illustrates how authenticated users, authorized for one resource, could potentially control other, unrelated resources within a cloud management dashboard.
Knight emphasized that her swarm technology is model-agnostic, built on a harness that equips AI models with domain-specific abilities for API hacking. This approach allows the AI to adapt to various API architectures and identify a wide range of security weaknesses.
The implications of insecure APIs extend beyond satellite systems. Similar BOLA vulnerabilities in cloud management dashboards could allow an authenticated user to escalate privileges and gain unauthorized access to sensitive data or critical infrastructure. As organizations increasingly rely on APIs to connect services and manage cloud resources, the security of these interfaces becomes paramount.
Knight's insights underscore a critical need for developers and organizations to prioritize API security throughout the development lifecycle. Implementing robust authorization checks, adopting secure coding practices, and leveraging advanced security testing tools like AI-driven swarms are essential steps to mitigate the growing risks associated with API vulnerabilities.