Salt Security Outlines API Framework for AI Agent Safety

Michael Nicosia, the COO and cofounder of Salt Security, asserts that the security of AI agents depends on securing the application programming interfaces (APIs) that enable them to execute actions. He argues that while current industry focus remains on models and prompts, the primary risk exists in the execution layer where agents interact with enterprise systems.

Nicosia warns that organizations are currently building guardrails around AI conversations while granting agents broad access to internal systems without sufficient visibility. He compares the current state of AI security to the virtualization that underpinned the cloud revolution, suggesting that the foundation of agentic AI must be secured to prevent systemic vulnerabilities.

To mitigate these risks, Nicosia recommends that security leaders create comprehensive inventories of APIs and agents. He advocates for the implementation of strict least-privilege permissions during deployment and suggests that organizations log agent behavior following authentication instead of focusing solely on access control.