Back to browse
Stop LLMs from brute forcing (guessing) APIs

Stop LLMs from brute forcing (guessing) APIs

by dervishcat·Mar 5, 2026·1 point·0 comments

AI Analysis

●●SolidBig BrainSolve My Problem

Self-describing API responses for agents, but REST + Problem Details already solve this partially.

Strengths
  • Backwards-compatible wire protocol means zero changes to existing clients.
  • Structured agent_guidance and next_actions fields reduce hallucination loops.
  • Works for success responses too, not just error codes.
Weaknesses
  • Competes with RFC 9457 Problem Details, which has IETF backing and broader adoption.
  • Requires API maintainers to adopt the standard—no network effect to drive adoption.
Target Audience

API developers building systems for AI agents

Similar To

RFC 9457 Problem Details · GraphQL error handling · JSON:API error objects

Post Description

My AI agents keep brute forcing and guessing API interfaces even when specs and documentation are provided. Even with full API specs, a discovery endpoint, and up-to-date documentation, the agent kept trying random formats, guessing parameters, and doing unnecessary trial and error.

I was able to fine tune the agent client-side and then it worked until the context cleared, but I didn’t want to hard code into context/agents.md how to access an API that will keep changing. I hate all this non-deterministic programming stuff but it's still too good to not do it :)

----> Problem Anyway, the problem was simple: API responses only returned results, because they adhered to the usual, existing protocols for REST.

There was no structure telling the agent what it should do next. Because of that I constantly had to correct the agent behavior on the client side.

Every time the API specs changed or the agent’s context was cleared, the whole process started again.

----> aaaand, Solution!

That’s what led me to TEKIR.

Project repo: https://github.com/tangelo-ltd/tekir/

---- TEKIR extends API responses with fields like: > next_actions > agent_guidance > reason

allowing the API to explicitly tell the AI what to do next.

This applies not only to errors, but also to successful responses.

For example, when an order is confirmed the API can guide the agent with instructions like:

>>> "show the user a summary tracking is not available yet cancellation is irreversible so ask for confirmation"

Instead of the agent trying to infer the workflow.

----> TEKIR plays well with existing standards.

TEKIR works without breaking existing APIs. It is compatible with RFC 9457 (Problem Details for HTTP APIs) and is language and framework independent.

There is an npm package and Express/Fastify middleware available, but you can also simply drop the markdown spec into your project and tell tools like Claude or Cursor to make the API TEKIR-compatible.

----> There is a different to the existing RFC 9457 (problem details) and HATEOAS

RFC 9457 is very problem-oriented - it explicitly describes errors. TEKIR goes beyond that. It is a guideline for future interactions, somewhat similar to HATEOAS, but with better readability and specifically tailored to automated agents.

---> A little background stuff

Why the name "Tekir"?

"Tekir" is the Turkish word for a tabby cat. Tabby cats are one of nature’s most resilient designs - mixed genes over thousands of years, street-forged instincts. They evolved beyond survival; they adapt and thrive in almost any environment.

That is the notion I wanted to bring into this dynamic API design as well.

----> I don't think anybody will read up to this point so i feel brave.

There’s also a more personal side to the name. In January this year my beloved cat Çılgın (which means “crazy” in Turkish) was hit by a car. I couldn’t get it out of my head, so I named this project after him so that in some way his name can live on. He was a tekir. Extremely independent, very intelligent, and honestly more “human” than most AI systems could ever hope to be, maybe even most humans.

The idea behind the project reflects that spirit: systems that can figure out what to do next without constant supervision.

I also realized the name could work technically as well:

TEKIR - Transparent Endpoint Knowledge for Intelligent Reasoning

---->> The project links

Project page (EN / DE / TR) https://tangelo-ltd.github.io/tekir/

GitHub https://github.com/tangelo-ltd/tekir/

I normally don't go out of my way to make a fuzz about such ideas but the recent emergence of tons of tiny ideas into community efforts got my hopes up, would be interesting to know if others building agent-driven systems have run into the same API interaction problems, maybe I'm just "using it wrong".

Similar Projects

AI/ML●●Solid

Brute-force startup ideation with the Ralph Loop

The core trick is simple and effective: let an agent iterate questions against a defined domain overnight and surface hundreds of candidly-annotated ideas you can scan through later. It nails the “fire-and-forget” idea dump and domain steering (tell it to focus on agencies or cybersecurity and it pivots), but it’s still essentially a convenience wrapper around an existing agent pattern — useful for volume and pattern recognition, less convincing on long-term validation or downstream filtering.

Rabbit HoleNiche Gem
bothlabs
204mo ago
Security●●Solid

FortiGate SSL-VPN Honeypot

FortiGate honeypot with counter-intel credential tracking and VT/OTX reporting.

Niche GemShip It
pgj11
101mo ago
SecurityMid

WordGen a Robust Wordlist Maker

Go-based wordlist generator competing with Crunch and CUPP in a crowded security space.

Ship It
CzaxTanmay
102mo ago