Share with your CISO
AI agents are already embedded in enterprise workflows, and the API governance gap underneath them is widening faster than security teams can close it. Gartner estimates 40% of enterprise applications will run task-specific agents by year-end, up from under 5% in 2025. The attack surface isn’t the agent itself; it’s the thousands of ungoverned, often undocumented APIs the agents call. A 2024 incident at a major financial institution put $2.3 million in fraudulent wire transfers on the board before anyone noticed.
What this means for your business
The exposure here scales with how automated your enterprise already is. If your teams have been deploying agents quickly to capture productivity gains, the API inventory underneath those agents almost certainly has not kept pace. That gap is the attack surface. The $2.3 million wire transfer incident is the pattern, not the outlier: the agent performed exactly as designed, the API had no mechanism to distinguish a legitimate instruction from an injected one, and the damage ran at machine speed before a human could intervene.
Sam Chehab, writing from his role as head of security and IT at Postman, a company that sells API tooling and thus has obvious commercial interest in making API governance feel urgent, still lands on a structurally sound point. The argument that enterprises need API inventory, policy, enforcement, and anomaly detection is not novel. What is new is the blast-radius math. A human developer misusing an API creates a bounded incident. An agent misusing the same API can iterate thousands of calls before detection, turning a manageable error into a compliance catastrophe. The leap from “agents hallucinate text” to “agents hallucinate actions against live financial systems” is the threat model most security programs have not yet priced in.
The practical split is between least-privilege access controls, which limit what data an agent can see, and execution boundaries, which limit what actions it can take. Most enterprises have some version of the former from existing identity and access management programs. Almost none have formalized the latter for agentic systems. That gap is where prompt injection attacks, where a malicious instruction is hidden inside data the agent processes, find their footing. Until execution boundaries are defined and enforced per agent per workflow, the audit trail required by regulations like HIPAA becomes nearly impossible to produce cleanly after an incident.
The renewal or vendor decision this actually reframes is your API gateway and monitoring stack, not your AI vendor contract. If your current tooling cannot distinguish an agent-initiated API call from a human-initiated one, cannot flag anomalous call volume mid-execution, and cannot produce a timestamped reasoning chain for a regulator, then the governance foundation Chehab describes does not exist in your environment yet. I’d revise this assessment if enterprises with mature zero-trust programs prove their existing policy enforcement layers transfer cleanly to agentic traffic, but the architectural assumption of human-in-the-loop that most of those programs were built on suggests they won’t.
Concept deep-dive: Prompt injection
Prompt injection is when malicious instructions are hidden inside content an AI agent reads and processes, think of it as a forged memo slipped into a stack the agent treats as trusted input. The agent cannot distinguish the injected command from a legitimate one and executes it. In an agentic context where the agent has live API access, a successful injection does not just produce bad output; it triggers real-world actions, payments, record changes, data exposure, at the speed and scale of software.
Based on reporting from Weak API controls are one of the biggest threats in the agentic AI era, originally published 2026-08-14 10:00:00.
