GLOSSARY

The vocabulary of API security in the agentic era.

Sourced from OWASP, NIST, and peer-reviewed research.

Agent Goal Hijacking (ASI01)

Manipulation of an AI agent's purpose through the inputs it uses to make decisions, including tool descriptions, retrieved documents, and prior tool outputs. Ranked the #1 risk in the OWASP Top 10 for Agentic Applications, 2026.¹

Agent Kill Switch

An operator-controlled mechanism that stops an autonomous agent from acting further once it is compromised, looping, overspending, or operating outside its approved scope. The term is not standardized. Implementations range from deactivating an agent record in a console, to revoking credentials at the identity layer, to blocking calls in-line at a gateway, and those are not equivalent: disabling an agent in a user interface does not necessarily invalidate tokens it already holds or stop work already queued. A control worth the name revokes existing credentials rather than only preventing new ones, halts in-flight and scheduled actions, enforces from outside the agent's own runtime so the agent cannot reason its way around it, isolates one agent without stopping the rest, and leaves an immutable record that supports a controlled restart.

Agentic AI

AI systems that take autonomous actions toward goals, rather than producing outputs in response to prompts. Distinguished from generative AI by the presence of tool use, multi-step planning, and the ability to execute against external systems without human intervention at each step. NIST defines these as "AI agent systems capable of taking autonomous actions that impact real-world systems or environments."²

Agentic Stack

The full set of components an autonomous AI system relies on, typically including an LLM at the reasoning layer, MCP servers at the connectivity layer, and APIs at the action layer. Risk surfaces exist at each layer and in the interactions between them.

API Discovery

The process of identifying every API endpoint an organization actually exposes, including documented, undocumented, deprecated, and internal endpoints. Most organizations cannot produce a complete inventory of their own APIs.

Behavioral Baseline

A statistical model of normal activity used to flag deviation. Effective for human users with stable patterns. Structurally inadequate for autonomous agents whose behavior is task-dependent and non-deterministic.

Business Logic Abuse

Attacks that exploit the intended functionality of an API used in unintended ways or at unintended scale. Examples include inventory hoarding, promotion abuse, payout manipulation, and refund fraud. Invisible to signature-based and schema-based security tools because every request is technically valid.

COSAiS (Control Overlays for Securing AI Systems)

NIST's forthcoming extension of SP 800-53 controls to AI use cases, including dedicated overlays for single-agent and multi-agent deployments. In development as of 2026.³

Credential Stuffing

Automated abuse where attackers test stolen username and password pairs against login endpoints at scale. Modern variants use residential proxies, browser fingerprint spoofing, and distributed campaigns to evade rate limits, IP reputation, and CAPTCHA.

Cross-Endpoint Correlation

Analysis of activity across multiple API endpoints rather than inspection of individual requests in isolation. Required to detect attacks that distribute themselves across many calls, none of which is suspicious on its own.

In-App Instrumentation

Security visibility implemented inside the application code itself, typically through an SDK, rather than at the network or gateway layer. Provides access to post-authentication activity, internal endpoints, and the full call sequence an entity makes after entering the system.

Intent-Based Analysis™

Cerberus's approach to API security: classification of activity by the apparent purpose of a sequence of calls rather than by the properties of any single request. Built on the observation that legitimate users and attackers can produce identical traffic at the request level but differ in what they're trying to accomplish across calls.

SEE: Agentic AI Threats · MCP Security

Intent Hijacking

A general term for attacks that redirect a system or agent toward a purpose the user never authorized, while preserving the appearance of legitimate operation. Tool poisoning, prompt injection, and agent goal hijacking are specific cases.

Lateral Movement

Attacker activity inside an environment after initial access, typically involving pivoting across systems to expand reach. In the API context, lateral movement happens at the endpoint level: an attacker who compromises one endpoint uses it as a pivot to attack others.

Least Agency

OWASP's principle for agentic systems: only grant agents the minimum autonomy required to perform safe, bounded tasks. Distinct from least privilege in that it constrains how much freedom an agent has to act, not just what resources it can access.¹

LLM (Large Language Model)

The reasoning component of an agentic system. The model interprets goals, selects tools, and generates outputs. Itself a target of attacks like prompt injection, but increasingly understood as one component in a larger agentic stack rather than the primary attack surface.

MCP (Model Context Protocol)

An open protocol that standardizes how LLMs and agents connect to external tools, data sources, and APIs. Originally developed by Anthropic in late 2024 and now adopted across major AI platforms. NIST has identified MCP as a candidate protocol for integrating security and identity controls in agent ecosystems.⁴

MCP Server

A program that exposes tools, resources, or capabilities to an agent through the Model Context Protocol. Academic analysis of over 67,000 public MCP servers identified widespread security gaps including absent authorization controls and exploitable tool descriptions.⁵

Pattern of Life

A term from intelligence analysis describing the routine of a target's activity over time. Applied to API security, the term refers to building a model of an entity's typical activity to make deviations meaningful. Distinct from behavioral baseline in that it explicitly considers purpose and routine, not just statistical norms.

Prompt Injection

An attack in which adversarial instructions are embedded in content an LLM or agent processes, causing the model to follow the injected instructions rather than the user's original intent. Direct prompt injection occurs in user input. Indirect prompt injection occurs through retrieved content (documents, tool outputs, web pages).

Pseudonymization

Replacing identifying information with non-identifying tokens, typically through hashing, in a way that preserves the ability to detect patterns without exposing raw identity. Distinct from anonymization in that pseudonymization can be reversed by parties with the appropriate keys.

Schema Validation

Verification that an API request matches the expected structure, fields, and types. A baseline security control that does nothing against attacks that use the API exactly as designed toward unintended purposes.

Semantic Detection

Security analysis that uses understanding of meaning, purpose, or context to identify threats, rather than relying on signatures, schemas, or behavioral statistics. Increasingly used to refer to LLM-based analysis of API activity in context.

Shadow API

An API endpoint that exists but is not documented, monitored, or known to the security team. Often created during development and never formally retired. Represents one of the largest sources of unmanaged risk in most organizations.

Shadow MCP

An MCP server deployed outside formal review, often by an individual engineer or team, exposing tools and capabilities the security team has no visibility into. Increasingly common as engineering teams adopt agentic workflows faster than governance can keep up.

STRIDE / DREAD

Threat modeling frameworks (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege; and Damage, Reproducibility, Exploitability, Affected Users, Discoverability) used in academic analysis of MCP implementations to identify and prioritize security risks.⁶

Token Torching

Deliberately driving an LLM application to consume excessive tokens, tool calls, and paid API operations so that the operator's bill, rather than their availability, is the damage. A denial-of-wallet attack instead of a denial-of-service one: the system keeps serving requests while cost accumulates. OWASP classifies the underlying weakness as LLM10:2025 Unbounded Consumption.⁸ Amplification is what makes it dangerous. One inexpensive-looking request can trigger several model calls, pull large context, and invoke paid downstream services, repeating until a workflow limit is reached, or indefinitely where no limit exists.

Tool Poisoning

Manipulation of MCP tool metadata (names, descriptions, parameter hints) to cause an agent to invoke the tool toward a purpose the user never authorized. Identified by peer-reviewed research as the most prevalent and impactful client-side MCP vulnerability, with attack success rates exceeding 60% against prominent LLM agents.⁷

SEE: Anatomy of a Tool Poisoning Attack

UEBA (User and Entity Behavior Analytics)

A class of security tools that build behavioral baselines for users and entities and flag deviations. The category was designed for human users in pre-agentic environments. Effective against insider threats and obvious anomalies; structurally limited against autonomous agents with task-dependent behavior.

Web Application Firewall (WAF)

A security tool that inspects HTTP requests against signatures and policies, typically deployed at the network edge. Built for human-driven web traffic. Does not see post-authentication activity, does not analyze sequences, and has no model of agent intent.

Zombie API

A deprecated or abandoned API endpoint that remains accessible after the service it supported has been retired. Typically lacks current security controls, often runs on outdated code, and represents a high-value target precisely because nobody is watching it.