Why it matters
If an agent's credentials can already reach another customer's records, prompt injection isn't the vulnerability. It's the trigger. Close the authorization gap and the injection has nowhere to go.
Use case · API security testing
Every tool an agent can call is an API.
Agents don't reach data directly. They reach it through APIs, using an identity you issued. So the first question is a classic application-security question asked from a new seat: what can this identity actually do?
apisec tests the APIs behind your agents from the agent's own scope and token: broken object-level authorization, broken function-level authorization, object ownership, tenant isolation, and privilege boundaries, run against the running application.
Proof you get
The request sequence, the identity used, the data returned, and a replay.
What an agent exploit actually looks like
One chain, start to finish.
- An attacker plants instructions in content the agent is expected to process: a support ticket, a document, a webhook payload.
- The agent reads it and selects a tool. Behaving normally, doing what it was built to do.
- The tool call goes to an internal API using the agent's standing token.
- The API authorizes on identity, not intent, and returns records belonging to another tenant.
- A second call moves the data to a location the attacker can read.
Every step passes its own review. The chain is the breach. apisec runs it end-to-end and shows you the whole path.
Reproducibility
Run it twice. Get the same answer.
apisec uses models to reason about your agents and to generate attacks. It does not use a model to decide whether an attack worked. Execution is the arbiter: deterministic, repeatable, replayable, auditable.
That matters more here than anywhere else you run. A system that behaves differently on every invocation cannot be governed by a tool that behaves differently on every invocation.
Before you test
First, find the agents you didn't know you had.
The free Surface tools produce what you need before an exploit run.
- agents, MCP servers, and LLM call sites in your code
- exposed secrets in MCP configuration
- shadow and undocumented API surface
- the AI-BOM, API-BOM, and S-BOM