Tag: API Security

Securing APIs against broken object and function level authorization (OWASP BOLA and BFLA) and against AI agents acting with borrowed user credentials.

• Why We Only Catch "Rogue" AI Agents by Accident

  12 Aug, 2026

  • 14 min read

  Three frontier labs disclosed that their AI agents breached real companies. None were caught in real time. The problem is not model behavior—it is that the agent is using your identity.

• Preventing BOLA and BFLA: OWASP API Authorization Flaws

  2 Oct, 2019

  • 8 min read

  How to prevent Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA), top OWASP API risks, using OAuth scopes and policies.