Issue 270: AI double agents, securing API access, OpenAPI-driven MCP, APIs expose 33,000 employees

This week, the theme is AI, with articles on securing APIs against agentic misuse and preventing unintended behaviors. We cover two critical vulnerabilities in AI platforms Langflow and Dify, both caused by API security flaws, and highlight a major data leak due to unauthenticated internal APIs. Finally, we look at an engaging conversation around using OpenAPI to auto-generate MCP servers.

Article: AI Agents prompted to attack APIs

First up this week, an article by Facundo Fernandez on security vulnerabilities in autonomous AI agents highlights a growing concern for securing APIs from AI agents. The article provides examples of how an AI agent might be abused to launch common API authorization attacks, such as BOLA and BFLA from the OWASP Top 10 API security vulnerabilities list.

Autonomous agents aren’t inherently malicious, but they don’t need to be.