--- title: Agents Turn Broken Auth Into a Breach at Machine Speed description: Broken object-level authorization (BOLA) has long topped API security lists, but AI agents change the risk calculus by removing the human friction that used to... canonical: https://daily.dev/posts/agents-turn-broken-auth-into-a-breach-at-machine-speed-ew6xjsbnf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Agents Turn Broken Auth Into a Breach at Machine Speed | daily.dev og:description: Broken object-level authorization (BOLA) has long topped API security lists, but AI agents change the risk calculus by removing the human friction that used to... og:url: https://daily.dev/posts/agents-turn-broken-auth-into-a-breach-at-machine-speed-ew6xjsbnf og:image: https://api.daily.dev/og/posts/EW6xjSBNf.png og:image:alt: Agents Turn Broken Auth Into a Breach at Machine Speed og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Agents Turn Broken Auth Into a Breach at Machine Speed **[API Evangelist](https://daily.dev/sources/apievangelist)** · 4 min read · 0 upvotes · 0 comments ## Summary Broken object-level authorization (BOLA) has long topped API security lists, but AI agents change the risk calculus by removing the human friction that used to limit exploitation. Referencing the 2022 Optus breach as a concrete example, the piece argues that agents—malicious or simply well-intentioned—can enumerate entire keyspaces at machine speed, turning slow-leak vulnerabilities into full-table breaches. The recommended fix is unglamorous but urgent: enforce object-level authorization on every request, return only entitled fields, treat rate limits as hard limits, and assume every API consumer can generate machine-speed traffic. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is broken object-level authorization (BOLA) in APIs? BOLA is an API flaw where the system checks that a caller is authenticated but fails to verify that the specific record requested actually belongs to them, letting one user retrieve another user's data, such as record 1002 when they should only access record 1001. It has topped API security risk lists for years and becomes far more dangerous when automated agents can enumerate every ID at machine speed. _Teams hardening API authorization can follow ongoing coverage of BOLA and agent-driven attack patterns on daily.dev._ ### How did the 2022 Optus data breach happen? An exposed API with insufficient authorization controls let an attacker iterate through customer identifiers, leaking the personal data of millions of Optus customers without requiring exotic tooling or nation-state resources. The API simply trusted the caller more than it should have, and someone was willing to enumerate records manually, foreshadowing what automated agents can now do far faster. _Anyone assessing API breach risk from automated agents can track similar incident analyses on daily.dev._ ### Why do AI agents make existing API vulnerabilities more dangerous? Agents remove the friction that once limited exploitation of known flaws like missing authorization checks or unenforced rate limits, since they can enumerate entire keyspaces tirelessly and at high speed without getting bored, unlike human attackers. This applies even to well-intentioned agents, which can hammer an API past its assumed access patterns and produce traffic nearly indistinguishable from malicious abuse. _Developers designing APIs for agentic traffic can follow practical authorization and rate-limiting guidance on daily.dev._ ## Similar posts on daily.dev - [Why AI Agents Write Broken Access Control](https://daily.dev/posts/why-ai-agents-write-broken-access-control-7drb4bp0v) · Snyk · 1 upvotes · 0 comments - [Everyone Knows About Broken Authorization – So Why Does It Still Work for Attackers?](https://daily.dev/posts/everyone-knows-about-broken-authorization-so-why-does-it-still-work-for-attackers--exddy4tnt) · Security Boulevard · 1 upvotes · 0 comments - [Active defense: introducing a stateful vulnerability scanner for APIs](https://daily.dev/posts/active-defense-introducing-a-stateful-vulnerability-scanner-for-apis-7txzytj75) · Cloudflare · 4 upvotes · 0 comments - [we are building data breach machines and nobody cares](https://daily.dev/posts/we-are-building-data-breach-machines-and-nobody-cares-qcskpagwt) · Hacker News · 3 upvotes · 0 comments - [AI agents are a confused deputy with the keys to your kingdom](https://daily.dev/posts/ai-agents-are-a-confused-deputy-with-the-keys-to-your-kingdom-hdyex7svh) · Stack Overflow Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/agents-turn-broken-auth-into-a-breach-at-machine-speed-ew6xjsbnf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Agents Turn Broken Auth Into a Breach at Machine Speed","url":"https://daily.dev/posts/agents-turn-broken-auth-into-a-breach-at-machine-speed-ew6xjsbnf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/agents-turn-broken-auth-into-a-breach-at-machine-speed-ew6xjsbnf"},"datePublished":"2026-08-12T10:11:29.660Z","dateModified":"2026-09-13T20:57:56.189Z","description":"Broken object-level authorization (BOLA) has long topped API security lists, but AI agents change the risk calculus by removing the human friction that used to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f5fd4487e9d707bbd5f9d10543b0c8fa?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f5fd4487e9d707bbd5f9d10543b0c8fa?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"API Evangelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"API Evangelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a36244ae67bc4f41a605f780267ecb5f","url":"https://daily.dev/sources/apievangelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/agents-turn-broken-auth-into-a-breach-at-machine-speed-ew6xjsbnf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,authorization","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"API Evangelist","item":"https://daily.dev/sources/apievangelist"},{"@type":"ListItem","position":3,"name":"Agents Turn Broken Auth Into a Breach at Machine Speed"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/agents-turn-broken-auth-into-a-breach-at-machine-speed-ew6xjsbnf#faq","mainEntity":[{"@type":"Question","name":"What is broken object-level authorization (BOLA) in APIs?","acceptedAnswer":{"@type":"Answer","text":"BOLA is an API flaw where the system checks that a caller is authenticated but fails to verify that the specific record requested actually belongs to them, letting one user retrieve another user's data, such as record 1002 when they should only access record 1001. It has topped API security risk lists for years and becomes far more dangerous when automated agents can enumerate every ID at machine speed. Teams hardening API authorization can follow ongoing coverage of BOLA and agent-driven attack patterns on daily.dev."}},{"@type":"Question","name":"How did the 2022 Optus data breach happen?","acceptedAnswer":{"@type":"Answer","text":"An exposed API with insufficient authorization controls let an attacker iterate through customer identifiers, leaking the personal data of millions of Optus customers without requiring exotic tooling or nation-state resources. The API simply trusted the caller more than it should have, and someone was willing to enumerate records manually, foreshadowing what automated agents can now do far faster. Anyone assessing API breach risk from automated agents can track similar incident analyses on daily.dev."}},{"@type":"Question","name":"Why do AI agents make existing API vulnerabilities more dangerous?","acceptedAnswer":{"@type":"Answer","text":"Agents remove the friction that once limited exploitation of known flaws like missing authorization checks or unenforced rate limits, since they can enumerate entire keyspaces tirelessly and at high speed without getting bored, unlike human attackers. This applies even to well-intentioned agents, which can hammer an API past its assumed access patterns and produce traffic nearly indistinguishable from malicious abuse. Developers designing APIs for agentic traffic can follow practical authorization and rate-limiting guidance on daily.dev."}}]} ```