Akto for AI / ML engineers
What middleBrick covers
- Read-only scanning of model and inference endpoints
- Authentication support for Bearer, API key, Basic, and Cookie
- LLM adversarial probe detection across scan tiers
- OpenAPI 3.0/3.1 and Swagger 2.0 spec validation
- Integration with CI/CD and monitoring workflows
- Continuous monitoring with diff and alerting
Security posture for AI and ML workflows
API interactions are central to training pipelines, model serving, and feature stores. The scanner evaluates endpoints used by AI and ML workloads using read-only methods, focusing on authentication, data exposure, and unsafe consumption patterns. It maps findings to OWASP API Top 10 (2023) and supports audit evidence for SOC 2 Type II and PCI-DSS 4.0.
Scan coverage for model and data endpoints
The scanner inspects URLs without code access or SDK integration, making it suitable for third-party model APIs and internal inference services. It detects authentication bypass, JWT misconfigurations, PII patterns including Luhn-validated card numbers and context-aware SSN, and LLM-specific adversarial probes across Quick, Standard, and Deep tiers. Findings include rate-limit headers, oversized responses, and sensitive API key formats such as AWS and GitHub tokens.
- Authentication issues including multi-method bypass and security header misconfigurations
- LLM security probes testing for system prompt extraction and jailbreak techniques
- Data exposure checks for PII, API keys, and error leakage
- Input validation checks for CORS wildcard and dangerous HTTP methods
- Inventory and unsafe consumption surface analysis
OpenAPI spec validation in ML environments
It parses OpenAPI 3.0, 3.1, and Swagger 2.0 with recursive $ref resolution, cross-referencing the spec against runtime behavior. This helps identify undefined security schemes, deprecated operations, missing pagination, and sensitive fields not declared in the contract. The analysis aligns with security controls described in SOC 2 Type II and PCI-DSS 4.0 and helps you prepare for audit reviews.
Authenticated scanning and domain verification
Authenticated scans support Bearer, API key, Basic auth, and cookies. Before scanning with credentials, domain verification requires a DNS TXT record or an HTTP well-known file to ensure only the domain owner can run authenticated checks. The scanner forwards a restricted allowlist of headers, including Authorization, X-API-Key, Cookie, and X-Custom-*, reducing exposure of internal headers.
Integration into development and monitoring workflows
Results are surfaced through a web dashboard with trend tracking and branded compliance PDFs. The CLI supports JSON and text output for scripting, and the GitHub Action can gate CI/CD when scores drop below a set threshold. For ongoing monitoring, the Pro tier provides scheduled rescans, diff detection, email alerts rate-limited to one per hour, and HMAC-SHA256 signed webhooks. The MCP Server enables scans from AI coding assistants such as Claude and Cursor.