6 API Injection Attacks You're Probably Not Testing For - API Developer Weekly

API Developer Weekly Oct 2, 2025 - Issue #561 We are back with some new articles for you. While AI is taking up most of the discourse, there were some API-specific articles as well. We start off with 6 commonly untested API injection attacks, along with the releases of OpenAPI v3.1.2 and v3.2.0. In addition, Janet Wagner takes a fresh look at hypermedia controls (a.k.a. HATEOAS) from an AI perspective. We also look at Cloudflare's recommendations for using MCP, the WordPress Abilities API, and a deep-dive into the OpenAPI Responses API. Finally, the Business of APIs section features two competing articles. Futurism says that AI coding is massively overhyped according to reports, while The New Stack says that AI has won universal dev adoption according to Google's DORA study. Yep, we are at that point now, in case you are keeping track. Finally, Dr. Werner Vogels reminds us of the basics when evaluating any new technology. This is what I've been trying to pound into developers everywhere - software is about solving problems for real people and using AI when appropriate for the solution. -- Happy Reading! Featured Articles 6 API Injection Attacks You're Probably Not Testing For Explore overlooked injection attacks in APIs, including JSON payloads, GraphQL, headers, templates, and more, with mitigation tips. by Kristopher Sandoval [nordicapis.com] OpenAPI Specification v3.1.2 The OpenAPI Specification (OAS) defines a standard, programming language-agnostic interface description for HTTP APIs. [spec.openapis.org] OpenAPI Specification v3.2.0 The OpenAPI Specification (OAS) defines a standard, programming language-agnostic interface description for HTTP APIs. [spec.openapis.org] HATEOAS: The API Design Style That Was Waiting for AI Explore how HATEOAS can solve AI agent challenges in tool calling, context, and runtime, reshaping API design for the AI era. by Janet Wagner [nordicapis.com] Code Mode: the better way to use MCP It turns out we've all been using MCP wrong. Most agents today use MCP by exposing the "tools" directly to the LLM. We tried something different: Convert the MCP tools into a TypeScript API, and then ask an LLM to write code that calls that API. The results are striking. [blog.cloudflare.com] The WordPress Abilities API This past Monday I guested on the This Week in WordPress podcast by my friend Nathan Wrigley. During the podcast we discussed the Abilities API. As I explained more about the related pull request, one of the listeners, Mark Wilkinson, asked: What is an... [jonathanbossenger.com] Why we built the Responses API How the Responses API unlocks persistent reasoning, hosted tools, and multimodal workflows for GPT-5. [developers.openai.com] Business of APIs AI Coding Is Massively Overhyped, Report Finds The AI industry's claims about AI coding assistants boosting productivity significantly appear to be massively overblown, per a new report. by Victor Tangermann [futurism.com] AI Has Won: Google's DORA Study Shows Universal Dev Adoption Google's latest DORA report reveals that 90% of software teams now use AI daily, but success depends more on organizational adaptation than tool adoption. by Darryl K. Taft [thenewstack.io] The Dwindling Firehose: What Happens When Data Shuts Off APIs are increasingly restricting access, raising risks of data silos and stalling AI. Here's what developers need to know. by J Simpson [nordicapis.com] (Un)Related Development gets better with Age He has heard the whispers, "he is getting older, who will replace him?" People asking him with a straight face, "when will you retire?" After close to 25 years at Amazon, where each year has been different and amazing, He feels as young as the day he decided to leave academia and join Amazon. by Dr Werner Vogels - https://www.allthingsdistributed.com/ [allthingsdistributed.com] Upcoming Events Platform Summit 2025 Engineer next-gen API architectures Oct 13-15 Stockholm, Sweden Discount code: ps25-apidvwk - good for 15% off any ticket until Oct 15, whether for the full conference, the half-day API Security UnConference, or a bundle. Tickets and registration API Economy Summit / Melbourne "Turning API Economy aspirations into realities for people and teams" Headliners TBA October 30, 10am-3:30pm Details and registration (Contact Claire Barrett for more details) apidays Amsterdam Explores how APIs are the foundation of enterprise GenAI readiness. November 6, 2025 Amsterdam, Netherlands Details and registration apidays Paris API governance, monetization, and future trends December 9–11, 2025 Paris, France Details and registration API Economy Summit / Paris "Powering the API Economy" Headliners TBA December 10, 10am-4pm Details and registration (Contact Bertrand Masson) Have something to share? As always, if you want to chat, share a link, or make a suggestion, feel free to drop us a quick note or tagging us on Twitter (@launchany and @caseysoftware) or by emailing us at: james@launchany.com. Want to change how you receive these emails? You can update your preferences or unsubscribe from this list.