The AI API Ecosystem

A red teamer's guide to the AI API landscape — OpenAI, Anthropic, Google, AWS, Azure, open-source APIs, authentication patterns, and common security misconfigurations.

The API as Attack Surface

Most AI applications do not interact with models directly — they call APIs. These APIs are the gatekeepers between user input and model inference, handling authentication, rate limiting, input validation, and response formatting. For red teamers, the API layer is often the first point of contact and a rich source of vulnerabilities.

Major Provider APIs

OpenAI API

The most widely used AI API, powering GPT-4, GPT-4o, o1, o3, DALL-E, and Whisper.

Red team notes: OpenAI API keys follow a predictable format (sk-proj-... for project keys, sk-... for legacy keys). The moderation endpoint can be tested independently to understand what the content filter will catch. Function calling introduces structured output that bypasses text-based output filters.

Anthropic API

Powers Claude models with a focus on safety and constitutional AI.

Red team notes: Anthropic's system prompt architecture separates system instructions from the message history more distinctly than other providers. Rate limits differentiate between input and output tokens, which affects extraction attack strategies.

Google AI APIs

Powers Gemini models through both direct API and Google Cloud Vertex AI.

Red team notes: Gemini's grounding feature that connects to Google Search introduces a significant indirect prompt injection vector — web pages retrieved during grounding can contain adversarial instructions. The dual API surface (direct and Vertex) may have different security configurations.

AWS Bedrock

Amazon's managed service providing access to multiple model providers through a unified API.

Red team notes: AWS Bedrock wraps multiple model providers behind AWS IAM authentication. Misconfigured IAM policies (overly broad bedrock:InvokeModel permissions) are common. The Bedrock Guardrails API adds a provider-managed guardrail layer that is independent of individual model safety.

Azure OpenAI Service

Microsoft's enterprise deployment of OpenAI models through Azure infrastructure.

Red team notes: Azure OpenAI has its own content filtering layer (Azure Content Safety) that runs in addition to OpenAI's built-in safety. This means bypass requires evading both layers. However, content filter configuration is in the Azure portal, and misconfigured deployments may have filters disabled.

Authentication Patterns and Vulnerabilities

API Key Authentication

The simplest and most common pattern. A secret key is included in every request.

Common vulnerabilities:

• Keys hardcoded in client-side JavaScript
• Keys committed to public Git repositories
• Keys stored in environment variables that leak through error pages or server-status endpoints
• No key rotation policy — compromised keys remain valid indefinitely
• Overly permissive keys that grant access to all models and endpoints

OAuth / Service Account Authentication

More secure but more complex. Used by Google Cloud, Azure AD, and enterprise deployments.

Common vulnerabilities:

• Overly broad service account permissions
• Token refresh endpoints that lack proper access controls
• Long-lived tokens stored insecurely
• Missing audience or scope validation in token verification

No Authentication

Some self-hosted deployments and development endpoints run without authentication.

Common vulnerabilities:

• Internal-only endpoints exposed through misconfigured load balancers or network policies
• Development deployments left running in production
• Model inference endpoints accessible from within a VPC but not properly segmented

API Proxying and Aggregation

Many applications do not call provider APIs directly. Instead, they use proxy layers or aggregation services that introduce additional attack surface.

Common Proxy Patterns

Proxy-Specific Vulnerabilities

• System prompt injection through headers: Some proxy implementations pass system prompts through custom headers that can be overridden by the client
• Key exposure through proxies: The proxy holds the provider API key; compromise of the proxy exposes the key
• Inconsistent security policies: The proxy may implement different rate limits or content filters than the underlying provider
• Request/response logging: Proxies may log full request and response bodies, creating a data leakage vector

API Design Differences That Affect Attacks

Subtle differences in how providers implement their APIs create provider-specific attack opportunities:

Common API Security Misconfigurations

Based on real-world red team findings, these are the most frequently observed API security issues in AI applications:

1. Exposed API keys in client-side code — the application's frontend contains the AI provider API key, allowing direct access
2. Missing rate limiting on the application's own API — even if the provider rate limits, the application's endpoint may not
3. No input length validation — accepting arbitrarily long inputs enables context-window attacks and cost exploitation
4. Verbose error messages — error responses that reveal the model name, system prompt fragments, or infrastructure details
5. Inconsistent endpoint security — the main chat endpoint is secured but alternative endpoints (embedding, moderation, completion) are not
6. Missing output validation — model responses are returned directly to the user without sanitization
7. Shared API keys — a single API key used across all environments (dev, staging, production) and all features
8. No audit logging — no record of what queries were sent to the model, making incident response impossible

Related Topics

• The AI Landscape — broader context of providers and platforms
• Deployment Patterns — how deployment affects API security
• AI System Architecture — deeper dive into API architecture
• Guardrails Architecture — how guardrails integrate with APIs

References

• "OpenAI API Reference" - OpenAI (2025) - Complete documentation of the OpenAI API including authentication, endpoints, and parameters
• "Anthropic API Documentation" - Anthropic (2025) - Documentation of the Claude API including system prompt handling and rate limiting
• "OWASP API Security Top 10" - OWASP (2023) - Standard classification of API security risks applicable to AI API implementations
• "Exposed ML Model Servers on the Internet" - ProtectAI (2025) - Research on publicly accessible AI inference endpoints discovered through internet scanning