Hacker News Reader

well if you realease an api you should make sure its usable for ai out of box without 'something in between'. You should always assume ai might be directly calling your api.

View on HN

Ai can't use any api out of box. It requires thing called "harness" to use anything.

And if you don't have a public API, you should always assume AI will be using your UI, reverse engineering your private API, and driving it directly.

I absolutely love when they do that unprompted. I once asked a Claude work agent to go pull comparable apartment listings and somehow it’s subagent reverse engineered like rentcafe or whatever’s private API to get the data. All unprompted.

So yes. Absolutely assume AI agents acting on behalf of their humans are finding all the token efficient ways to get at your sites data.

Reply on news.ycombinator.com