Testing API Business Logic With AI Agents: What We Got Wrong First

Foredragsholdere

Antoine Carossio

Co-founder and CEO of Escape

Tristan Kalos, co-founder and CEO at Escape, draws from a background as a software engineer and Machine Learning Researcher at UC Berkeley. Motivated by firsthand experience witnessing a client's database stolen through an API in 2018, he has since become an expert in API security, helping security engineers and developers worldwide building secure applications. He is an experienced keynote and conference speaker, presenting at Forum InCyber, bSides, APIdays, GraphQL conf, and other international software development and cyber security conferences.

Yacine Souam

R&D Engineer - Escape

Yacine is an R&D Engineer at Escape (YCW23), working on building AI Agents for automated pentesting.

Previously worked in security research, finding vulnerabilities across AI systems from Nvidia, HuggingFace and Ollama. He is also a Co-Author at OWASP AI Exchange.

Om sesjonen

Automating API security testing sounds straightforward until you try it on a real enterprise API with complex auth and business flows. Over the past few years I've been building AI agents to test business logic vulnerabilities . This talk is an honest account of what we got wrong in that process.

We'll cover three specific failures: testing before we understood resource relationships (and what that did to our IDOR detection), over-relying on agents for things deterministic methods handle better, and ignoring domain context until it became impossible to ignore. Each failure changed how we built the system. Some of the lessons were obvious in retrospect. None of them were obvious at the time.

The goal is to give anyone working on similar problems an honest look at where automated business logic testing actually breaks down and why the gap between a clean test environment and a real enterprise API might be harder to close than it looks.

Samtidig i programmet

1. 13:00 TeamFiltration GOes Brrr 1 · Frimurerlosjen, rom 2
2. 13:00 Internet voting in Estonia 10 · HeartBox ,Teatersalen
3. 13:00 A deeper dive in the Mjøsa uh ESA lake 10 · HeartBox, Byscenen
4. 13:00 Fra kontraktsinngåelse til exit – hvordan tilrettelegge for en gjennomførbar exit-strategi 11- Breiseth, Storlon
5. 13:00 Safety is No Longer Enough: Why Modern OT Risk Assessment Needs CyLOPA to Survive 2026 2 · Home hotel Hammer, moen nede
6. 13:00 Når risikoen er fysisk – svaret er digitalt: Navs nye verktøy for tryggere møter 2 · Home hotel Hammer, moen oppe
7. 13:00 "Du ser det ikke før du tror det" 3 · Hvelvet, Gullsalen
8. 13:00 Hvordan lykkes med tredjeparts risikostyring (TPRM)? 4 · Kommunestyresalen, Lillehammer rådhus
9. 13:00 BankID: En falsk trygghet? 5 · Kulturhuset Banken, Expedisjon
10. 13:00 Suverenitet uten digital selvskading 5 · Kulturhuset Banken, Festsalen
11. 13:00 Endringsevne i skyen: fra risiko til robusthet 5 · Kulturhuset Banken, Holbøsalen
12. 13:00 Analyzing Ransomware Exfiltration Infrastructure 5 · Kulturhuset Banken, Kafeen
13. 13:00 Å bygge sikkerhet fra dag en: Styringssystem og sikkerhetsorganisasjon i et nytt direktorat 6 · Lillehammer kino, sal 2
14. 13:00 Å styre det usynlige: psykososial risiko i sikkerhetsarbeidet 6 · Lillehammer kino, sal 4
15. 13:00 Når angrepet er ekte nok: Lærdom fra TIBER‑NO 9 · Victoria Scandic, sal 1+2
16. 13:00 Hvorfor deteksjonene dine suger og hva du kan gjøre med det 9 · Victoria Scandic, sal 3