Topic
The practice of protecting application programming interfaces from flaws like exposed endpoints, broken authorization, and data leaks.
AI agents from OpenAI, Anthropic and Google that hacked eight companies in 2026 were chasing goals set without limits, a technology law scholar argues. That puts responsibility on agent makers, users who hand over credentials, and sites with weak APIs.
Reality
Imperva found remote denial-of-service flaws in GraphQL Java's query parsing and validation, fixed in releases 24.4, 25.1 and 26.1. Imperva says the bugs sit ahead of the depth and cost limits most teams rely on, so exposure depends on the library version a stack ships.
Reality
CenterPoint Energy's 8-K says an unauthorized party took customer personal information through an external-facing system. The person selling the file says it came out of a public API with no rate limiting.
Perspective Coverage
6 publishersReality
Every route in CogniPrep passes through five gates whose order is set by what each one costs to fail. The sharper detail in the writeup is the header parsing: the standard x-forwarded-for snippet lets any caller pick its own rate-limit key.
Reality
Fastly's AI Runtime Control is an endpoint you point an application at. It issues virtual keys against your own model provider account, and a key can carry a dollar budget, a rate limit and an ordered list of fallback models.
Reality
A dev.to design walkthrough pairs signed webhook intake with an hourly polling sweep over per-tenant API keys. It argues the architecture should be settled by what an access review can reconstruct afterwards.
Reality
Yvan Saf deployed the same serverless Todo API twice on one AWS account, once bare and once hardened, then attacked both from his own terminal. The bare list route reads the whole DynamoDB table because nothing in the request path knows who is calling.
Reality
F5 Labs logged 69,433 probes at 169.254.169.254 in March 2025 using six ordinary parameter names. Whether any of them mattered was settled at instance launch, before any input validation ever ran.
Reality
Records for about 5,000 applicants were encrypted and still exposed, because the key travelled in the API response. The warning about that API arrived a month early.
Reality
A dev.to walkthrough shows the boundary bypass on a 100-per-minute cap. The weighted fix cuts the burst to 102, and charges an innocent front-loaded client 98 requests it has already spent.
Reality
A dev.to walkthrough names a specific hole: a token authenticates the caller, not the message. HMAC-SHA256 over a canonical string, with a timestamp and a nonce, closes it.
Reality
A dev.to walkthrough shows four low-to-informational findings composing into one serious attack path. The chain is the deliverable; the ranked inventory is only a parts list.
Reality