AI Agents Should Be Treated Like Hackers

Autonomous agents require secure, semantic access to enterprise data to function effectively, yet traditional APIs often lack the granularity required for this new paradigm. Matt DeBergalis, CEO of Apollo GraphQL, argues that agents must be treated as potentially adversarial, necessitating a shift toward zero-trust models where access is restricted to the thinnest possible data slices. GraphQL serves as a critical bridge here, offering strong typing and introspection that allow organizations to define explicit, field-level permissions for AI agents. Beyond technical implementation, the integration of the Model Context Protocol and GraphQL represents a fundamental shift in organizational structure, requiring multi-stakeholder alignment to manage the risks of autonomous decision-making. Ultimately, providing AI with structured, semantic entry points into business systems accelerates innovation while maintaining the necessary security boundaries for enterprise-grade operations.