APIs were built for human developers

@mlops.community

1.5K followers · usually 559 views a post

Views

30.3K

Likes

933

Comments

51

Shares

97

Why it worked

The video addresses a high-level, controversial technical concern within the AI industry, positioning the speakers as experts and inviting engagement through a provocative, counter-intuitive premise.

Summary

Two speakers discuss the security risks of using APIs with AI agents, noting that current APIs were designed for trusted human engineers. They argue that AI agents should be treated as untrusted or adversarial because they lack the human judgment and oversight inherent in traditional software development.

Structure

1Introduction of the security problem with APIs and AI agents
2Explanation of why traditional APIs rely on human trust
3Example of sensitive data in an HR system
4Call to treat AI agents as untrusted and adversarial
5Closing reflection on the lack of transparency in current AI models

On-screen text

API'S WERE'NT BUILD FOR AI AGENTS is a Security Problem in my view APIs were built for trusted users who know how to do Engineering they review each other's Code they rate limit a key all that is good human judgment of people I trust HR System HR system has Probably not something people should have I think we have to look at these agents as untrusted and even adversarial How many people are reading this code I think events of the last months with like OpenAI and the DoD really tell us how little we really know about what's happening inside the models and the harnesses

Original caption

APIs were built for human developers #aiagents #AI #LLM

More from @mlops.community

Their other posts in the index, biggest breakout first.

Transcript

APIs were built for trusted users. And what I mean by that is like they were meant to be used by engineers who know how to do engineering, they review each other's code. There's a whole bunch of rituals and processes that we've built over the last couple of decades. They rate limit a key, all that stuff. And underneath all that is human judgment. Good human judgment of people I trust, right? So if you wipe all that away, you've got a big problem. Because if you think about a typical API, for example, it's probably going to mix data that has very different levels of sensitivity. Like, I've got an HR system in our company. That HR system has a list of everybody and their time zone. That's really useful. It's also got, probably, I'm guessing, I'm not totally sure, but I think it has like their 401k contribution information or their health information. Probably not something people should have. I think we have to look at these agents as untrusted and even adversarial. How many people are reading this code? Or like, think about I think events of the last months with like OpenAI and the DoD, really tell us how little we really know about what's happening inside some of the models and the harnesses.