Treat AI Agents as Untrusted: Why APIs Built for Human Engineers Are a Security Problem

This 67-second podcast clip from the Agentic AI Foundation makes one pointed argument: the biggest and most immediate problem with AI agents calling APIs is security. APIs were designed for trusted human engineers who operate inside decades of accumulated process, and agents inherit none of that.

The speaker lands on a blunt conclusion. Agents should be treated as untrusted, and possibly adversarial, because we know too little about what happens inside models and their harnesses to assume otherwise.

APIs Assume Trusted Users

The clip opens with the framing that these APIs "were built for trusted users." That means engineers who know how to do engineering and who work inside guardrails built over the last couple of decades: they review each other's code, they rate limit keys, and they follow a whole set of rituals and processes.

Underneath all of that sits human judgment. The speaker calls it "good human judgment of people I trust." Wipe that layer away and hand the same API access to an agent, and you have a big problem, because nothing in the API itself enforces the judgment that used to surround it.

The HR System Example

The concrete example is an HR system. A typical API mixes data with very different sensitivity levels behind the same surface. The company's HR system holds a list of everybody and their time zone, which is genuinely useful. The same system likely also holds 401k contribution information and health information, which most people should not be able to see.

A human engineer knows the difference between pulling a time zone and pulling a health record. An agent hitting the same endpoint has no built-in reason to make that distinction, which is exactly why the mixed-sensitivity design that worked fine for trusted users becomes a liability.

Untrusted, Maybe Adversarial

The conclusion is that "we have to look at these agents as untrusted, maybe even adversarial." The speaker backs this with two observations. First, a question about oversight: how many people are actually reading the code these agents produce? Second, a reference to recent events involving Anthropic and the DoD, which he says show how little anyone really knows about what is happening inside some of the models and the harnesses that run them.

Key Takeaways

• APIs were designed for trusted human engineers backed by code review, rate limiting, and decades of process, and agents bypass all of it.
• The safety layer around APIs was never the API itself. It was human judgment, and agents remove that layer.
• Typical APIs mix data of very different sensitivity, like time zones next to 401k and health information in an HR system, so broad agent access exposes the sensitive parts along with the useful ones.
• The speaker's position is to treat agents as untrusted and possibly adversarial, since visibility into model and harness internals is limited.