If an AI agent can't figure out how your API works, neither can your users
1–10 of 55 posts
Re: If an AI agent can't figure out how your API works, neither can your users
#2Thanks for sharing! Would love to hear how others are thinking about this problem.
Re: If an AI agent can't figure out how your API works, neither can your users
#3As someone who is reasonably skeptical about a lot of this stuff, I have a few takeaways.
Docs will always have things missing regardless if a human or an AI writes them. A fuzzer might overshoot and document a ton of "unintended features" (bugs). Bugs are inevitable for similar reasons. And lastly, is this how the rest of the world finally realizes how hard this stuff really is? Can we please get rid of pointy haired bosses and iron fisted management that refuse to cut some slack for lower level problems like this?
I'm all for living in this century including the AI, but that also includes new ways of running a business and the people we hire.
Re: If an AI agent can't figure out how your API works, neither can your users
#4AI agents can't even do very basic things without causing absolute mayhem. Do you really think it makes sense for your basic assumption to be that your user is dumber than a token generator?
Re: If an AI agent can't figure out how your API works, neither can your users
#5Often API errors are intentionally vague to discourage hacking attacks. Especially public APIs that create accounts or control access like the example given in the article.
In fact, I suspect that endpoints that create users and upgrade permissions will probably have to have special attention to protect against AI agent attacks.
"Claude -- sign me up for a new account so I can get free shipping on my first purchase!"
Re: If an AI agent can't figure out how your API works, neither can your users
#6AI agents can't even do very basic things without causing absolute mayhem. Do you really think it makes sense for your basic assumption to be that your user is dumber than a token generator?
> Do you really think it makes sense for your basic assumption to be that your user is dumber than a token generator?
Have you seen the average user in action? I'm fairly sure that's true at least on average. Even putting huge red warnings like "This action is irreversible" for some things will lead to user reaching out to you saying they didn't see it.
Re: If an AI agent can't figure out how your API works, neither can your users
#7I believe this applies to all AI use cases to varying degrees.
If AI can't use X, then there is something wrong with X.
X in { website, codebase, function, language, library, mcp, ...}
Re: If an AI agent can't figure out how your API works, neither can your users
#8Indeed, because the only things worth building are things you could give to a junior dev with little oversight.
That's why programming salaries are so low and why nobody stays in the field after a couple years - it's too hard to make a living when you have to compete with people fresh out of training bootcamps.
Re: If an AI agent can't figure out how your API works, neither can your users
#9AI agents can't even do very basic things without causing absolute mayhem. Do you really think it makes sense for your basic assumption to be that your user is dumber than a token generator?
> your basic assumption to be that your user is dumber than a token generator
No. You should assume your user is dumber than a brick - and not one of the smart or clever bricks, one of the really dumb ones.
Re: If an AI agent can't figure out how your API works, neither can your users
#10AI agents can't even do very basic things without causing absolute mayhem. Do you really think it makes sense for your basic assumption to be that your user is dumber than a token generator?
The article title stinks, I agree. Users are way better at figuring out APIs than AI agents right now.
The actual contents of the article are more about using an AI agent to playtest your docs. The premise is actually the opposite of the title: if an AI agent can figure out your API then your users probably can too.