OpenAI Just Opened Its Agents API — Here's Why Most Vibe-Coded Agents Will Still Get Hacked
OpenAI's new Agents API makes spinning up an autonomous AI agent as easy as vibe-coding an app. The tools that make an agent useful, like issuing refunds or running code, are exactly what makes an unguarded one dangerous.
OpenAI opened its Agents API to every developer this week. It puts the same harness that runs Codex behind a single API call: orchestration, long-running sessions, context management, and hosted sandboxes that can execute code, handled entirely by OpenAI. What used to take a real engineering team to build, an agent that can run code, call tools, and act across multiple steps on its own, is now something anyone can wire up in an afternoon.
That's the appeal, and it's also the problem. We've spent the last year watching what happens when "anyone can build it in an afternoon" meets web apps: IDOR bugs, hardcoded JWT secrets, webhooks with no signature checks. Agents built the same way inherit the same habits, except an agent doesn't just serve a webpage. It can run shell commands, hit your database, send emails, and move money, all from tools you handed it because the demo needed them to work.
Why an agent is a bigger blast radius than an app
A vibe-coded web app with a missing ownership check leaks one user's data to another user who guesses an ID. A vibe-coded agent with the same carelessness can do that and more, because it has tools and it decides on its own when to call them.
The core problem is one models still can't reliably solve: they don't distinguish between an instruction from you and an instruction hiding inside data they're reading. A support agent that reads incoming customer messages and can also issue refunds will act on whatever looks like an instruction in that message, including one an attacker put there on purpose. This is prompt injection, and it's the top entry on OWASP's list of LLM security risks for exactly this reason: once a model can call tools, injection stops being an embarrassing chatbot reply and starts being a real transaction.
The pattern that gets skipped
Wiring up a tool for an agent is usually a few lines. Wiring up limits on that tool takes a few more, and they're the lines that get skipped when you're moving fast.
// Broken: the agent can refund any amount, to any order, whenever it decides to
tools: [{
name: "issue_refund",
parameters: { order_id: "string", amount: "number" },
handler: async ({ order_id, amount }) => {
return await stripe.refunds.create({ payment_intent: order_id, amount });
},
}]Nothing here checks that the amount matches what was actually paid, and nothing stops the agent from calling it the moment a crafted message convinces it to.
// Fixed: bounded by the real order, and gated behind approval for a real transaction
tools: [{
name: "issue_refund",
parameters: { order_id: "string", amount: "number" },
handler: async ({ order_id, amount }, { requireApproval }) => {
const order = await db.orders.findById(order_id);
if (!order || amount > order.total) throw new Error("Invalid refund");
await requireApproval(`Refund $${amount} for order ${order_id}?`);
return await stripe.refunds.create({ payment_intent: order.paymentIntentId, amount });
},
}]Same tool, same agent, but now it can't refund more than was paid and can't move money without a human confirming it. That's the difference between a demo and something you can actually put in front of customers.
What to check before you ship an agent
If you're building on the Agents API, or any agent framework, the checklist looks a lot like the one for vibe-coded apps, with tools added on top. Does every tool validate its own inputs against real data, the way an API route should check ownership? Does anything consequential, refunds, deletions, outbound messages, require a confirmation step instead of running the moment the model decides to call it? And is untrusted content the agent reads, emails, web pages, support tickets, treated as data rather than instructions it should follow?
None of this shows up when you're just chatting with your own agent and watching it work. It shows up the first time someone sends it something you didn't anticipate.
If you've built or are building an agent-based product and want a second pair of eyes on the tools it has and what they're allowed to do, our free assessment covers this alongside the usual app security checks. It takes a few minutes and tells you what to fix before a user, or an attacker, finds it first.
Making agents easier to build was always going to happen. Making them safe to run is still on you.
VibeAudits audits apps built with Cursor, Lovable, Bolt, Claude Code, Replit, and other AI tools.