When AI Agents Replace Human Users, Your API Design Must Fundamentally Change

·1 views

As AI agents increasingly act on behalf of users, software products built around traditional UIs risk becoming obsolete if their APIs are not designed as first-class interfaces. A key shift requires making API specifications fully public and accessible without prior registration, since agents cannot discover capabilities hidden behind developer portals. Rather than exposing raw CRUD operations, APIs should encode business intent as dedicated endpoints, reducing the risk of agents misinterpreting field combinations and causing errors in sensitive domains like accounting. Irreversible actions — such as closing a fiscal period or submitting records to tax authorities — must be structurally protected through explicit state controls, not left to prompt-level instructions. Authentication and onboarding for AI agents should also be streamlined, with scoped API keys and ready-made integration commands to eliminate manual configuration.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Punk: A Perl MVC Framework That Compiles All Routes at Boot Time

Punk is a new Perl MVC web framework designed to shift as much processing work as possible from request time to application boot time. By resolving all routes, controller methods, and middleware guards during startup, the framework reduces per-request overhead and surfaces configuration errors before the app begins serving traffic. The framework supports standard HTTP routing, WebSockets, Server-Sent Events, signed cookie sessions, CSRF protection, CORS handling, and OpenAPI 3.1 integration. It uses layered YAML configuration with built-in secrets redaction, and is built on a set of companion C-backed modules including a preforking PSGI server called Hyperman. A CLI tool, punk new, generates a fully functional application scaffold rather than a bare stub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds three personal verification scripts passed while the code they checked was broken

A solo developer who relies on self-written scripts to verify his work discovered that three separate checks reported success even though the underlying content or action they were meant to validate had failed. The first script validated row structure in a markdown log by counting separators, but passed a row where a status value was placed in the wrong column, catching shape rather than meaning. A second script failed to detect a missing paragraph because it measured separator counts, which remained unchanged after a botched insertion. A third and most consequential check confirmed an article had been saved in a web editor, but was reading the in-window state rather than the actually stored draft, causing a key disclosure paragraph to be silently lost. The developer concluded that passing checks can mislead when they are too shallow, aimed at the wrong location, or read transient rather than persisted state.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Study: Human Reviewers Miss 1 in 3 Dangerous AI Agent Commands in Testing

A study simulating 40,000 AI agent approval scenarios found that human reviewers failed to catch approximately 33% of genuinely harmful commands. The research focused on 'human-in-the-loop' checkpoints, where a person must approve or reject an AI agent's proposed action before it executes. Investigators found the core problem is not reviewer negligence but a lack of contextual information at the moment of decision, as dangerous commands often appear harmless without visibility into prior steps in the agent's chain. For example, a file-deletion command targeting a seemingly safe directory could be catastrophic if the agent had earlier redirected that path to a production environment — a detail typically hidden from the approver. Researchers suggest that surfacing full action traces alongside approval prompts, combined with automated critic models to pre-filter high-risk commands, could significantly improve oversight reliability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One MySQL query consumed 75% of CPU by scanning 16,000 rows to return just 6

A news platform began serving pages in over six seconds after a single MySQL full-text search query started dominating database activity, accounting for 75% of all active queries on the server. The query powered a 'related articles' feature, passing each article's full title and first 200 characters of its summary as a natural-language search term, which matched roughly 20% of the 80,000-row table on every execution. Because the ORDER BY clause ranked results by a computed relevance-to-age ratio, the database could not use an index, forcing it to score around 16,000 rows, load them into a temporary table, sort all of them, and discard nearly all to return just six results. The server's load average reached 16.7 on a 12-core machine, MySQL consumed 92% of CPU, and over 4.8 GB of memory spilled into swap. The investigation was resolved by sampling the process list repeatedly to identify the dominant query shape, rather than relying on a single snapshot or generic tuning measures.

0 comments Read more at DEV Community