API Security
,
Critical Infrastructure Security
Get Ready for More Hacks on Application Programming Interfaces
Shaun Waterman •
November 11, 2026
Image: Shutterstock
Application programming interfaces are often a hackable road to the inside of a corporate network. And yet they’re ubiquitous – with reason. Rather than run physical resources, developers can just call an API to spin up virtual servers, databases, artificial intelligence tools or other cloud-based resources on demand. See Also: Securing Microsoft 365: A Live Breakdown of Modern Attack Paths
Despite their starring role in many a hack, APIs are the IT “plumbing of our world today,” said Alissa Knight, a self-described “recovering hacker,” who was recruited by the U.S. intelligence community after being arrested. An API “plumbs our financial services and fintech. It plumbs our cars,” she said.
But increasingly, Knight told ISMG in an interview, APIs are getting less secure, not more. They are insecurely “vibe coded” by AI agents, rushed into production within days or even hours and not built in accordance with “shift left” or “secure by design” principles.
The Rosetta Stone of modern, agile IT, APIs are more and more also its Achilles’ Heel, because they are riddled with software vulnerabilities, said Knight, who is now CEO of Assail, a venture-backed cybersecurity company building agentic AI swarms to test the resilience of enterprise systems.
Knight’s demonstration of her technology at a Northern Virginia satellite cybersecurity conference last week showed a small swarm of AI agents finding, chaining and exploiting vulnerabilities in a synthetic environment she built to resemble a ground station, with an API modeled on one used to manage a satellite constellation.
The lab uses open-source software developed by NASA’s Jet Propulsion Lab to visualize data flows and show the impact of the swarm’s attack on the simulated constellation, she said.
But the vulnerabilities were real, recreating ones “I’ve personally discovered during previous security engagements,” Knight said. The idea is to show how those kinds of flaws “can be exploited and illustrate their potential consequences in a controlled environment,” she said.
The vulnerabilities her swarm found were broken object level authorization flaws – just like up to 98% of the vulnerabilities she finds in real life, she said.
“We do a really good job at authenticating, and a really terrible job at authorization,” Knight said.
The attack Knight demonstrated employed a “bearer token” which was issued by the dashboard once a user logged on. Because of BOLA, that token also allowed her to direct other satellites. “There was a bearer token that was issued to me, … scoped for Sat [number] 12, … but I now have full command access to Sat 47. I’m scoped for one satellite, but I can access any satellite in the constellation,” she said, as her AI swarm took command.
In a cloud management dashboard, similar BOLA vulnerabilities might allow a logged-in, authenticated user who is authorized to manage one resource, to take control of other resources.
The swarm technology is model agnostic, Knight said, and based on a harness which gives the model domain specific abilities and skills for API hacking.
Click Here For The Original Source.
——————————————————–
