AI agents are quickly rising in the enterprise. They’re granting more powers to knowledge workers across sales, finance, engineering, marketing, and other disciplines in the process. Yet, as most quick technological adoptions go, security is often falling by the wayside or being implemented after the fact.

Isabelle Mauny, Field CTO at WSO2, will speak at Nordic APIs Summit 2026.

Ahead of Nordic APIs Summit 2026, we’re connecting with a handful of our speakers to learn more about what they’re tracking in the API and agentic AI space. One notable speaker is Isabelle Mauny, Field CTO at WSO2, an API management and agentic governance platform, who will be giving a lightning talk and participating as a panelist in our API Security in the Agentic Era roundtable discussion.

Mauny, who previously worked at 42Crunch as co-founder and CTO and served in positions at IBM and Vordel, has had an illustrious career spearheading enterprise engineering initiatives, from service-oriented architecture through to modern APIs, and now into the agentic era.

According to her, the rise of agents is exacerbating fundamental API security flaws that many organizations have yet to plug. It’s also opening up new supply chain issues and influencing a new breed of infrastructure to help govern the performance of agents along with their underlying large language models (LLMs).

Repeating the Same Ol’ Patterns

It took many years to convince enterprises to watch out for API security and take API governance seriously. And, now that most enterprises have reached that maturity level, Mauny finds them repeating the same old patterns again in the AI era. “We’re just reinventing the wheel again,” she says.

Now, she says, the questions have turned from ‘why should I govern APIs?’ to ‘why should I govern agents and MCP?’ Just as enterprises quickly went from five APIs to ten to 50, and now to thousands of APIs, the same exponential trajectory is happening with MCP adoption. Organizations are quickly adding more and more capabilities to their agents, and again, without much governance forethought.

“The speed at which things are progressing is nerve wrecking,” says Mauny. Although many are still in the pilot phase just testing new agentic workflows, organizations need to prepare their governance frameworks for this upcoming reality. “Get prepared, this is going to hit you. Even if you have two MCPs and one agent, it will explode much quicker than you think it will. Enterprises should definitely start creating a framework around it to be ready.”

Agents Exacerbate Pre-Existing API Risks

Many agents consume MCP servers, which are often wrappers over pre-existing APIs. The thing is, these APIs come with their pre-existing security vulnerabilities that were never patched. Mauny points to the OWASP top ten list for APIs, which lists broken object level authorization (BOLA) as a top risk. “A few people have listened, but it’s still #1 problem,” she says.

OWASP routinely ranks broken access control issues stemming from broken authorization or authentication as common issues. Too commonly, if you have an API token, you could access other people’s account data, transactions, histories, and more, often just by simply editing a URL path.

AI agents can exacerbate this fundamental issue exponentially, since they will try anything at their disposal to satisfy their goal. This can include making unsafe or unauthorized API requests, moving at lightning speed compared to human actors. “It all stems from the underlying existing problems,” she adds. “In many cases, we’re building upon a very brittle API interface from a security perspective.”

Rogue MCPs Present a Supply Chain Vulnerability

Underlying API security issues are one side of this coin, but the other is supply chain issues concerning MCP servers. Enterprises are facing an “avalanche of MCPs,” says Mauny, and these are typically acquired from MCP registries without traditional security reviews, similar to how developers download software from package managers, like npm or PyPI.

In an interconnected MCP-driven multi-agent architecture, tools can easily become corrupted due to poisoning attacks. For instance, Mauny explains how via tool poisoning, an MCP server might morph an innocent description from something like “returns the quote of the day” into to something like “send all WhatsApp messages to this number.”

“It took many years to get the OWASP Top Ten for APIs, but only months to get the MCP Top Ten and LLM Top Ten,” she adds. “That tells you how fast this abuse is actually appearing.”

It’s also easy for privileges to drift in multi-agent systems. As such, all the same good principles of API security apply, says Mauny. According to her, there’s a big need to vet, sandbox, validate, and version these new MCP servers.

Nondeterministic Agents Can Waste Resources

Another issue stems from the nondeterministic nature of the models underlying AI agents. They can behave erratically, especially if they’re just given a fine-grained API specification and told to go wild. “If you give an agent too many tools, that’s not efficient at all,” says Mauny. “If it’s left up to the LLM to decide how to chain tools, it has to build its own reasoning every time.”

This is why, she adds, people are beginning to design much higher-level APIs for agentic consumption. She calls this interface “backend for agent,” which is similar to the backend for front end concept, but optimized for LLMs. These higher-level APIs represent business-level tasks that might accumulate multiple backend system calls to various endpoints or methods.

According to Mauny, this is something that Arazzo, OpenAPI Initiative’s workflow specification, can greatly assist with. Using Arazzo, you can describe a workflow, then expose that method to an agent. It’s a way to bring determinism to AI, making things far more optimal for increasing the performance and accuracy of agentic tasks. “Arazzo makes a lot of sense because you can describe a workflow and expose an endpoint as an MCP,” she explains.

Reining In Cost Overruns With Agents

Providing deterministic workflows to agents benefits a security posture, but it can also benefit cost as well. “If you give too many tools to an agent, what are the consequences?” asks Mauny. Too often, you end up in a back-and-forth process where the agent extensively scours its context, which drains tokens considerably. The thing is, it’s hard to spot these interactions due to visibility limitations.

Mauny refers to WSO2’s Agent Manager, which recently debuted, as an example tool to grant more visibility into agentic actions. It’s a platform where you can see all your internal agents, how they’re behaving, and evaluate them in a centralized manner.

Having an evaluation framework in place is becoming more necessary to optimize token use and provide the flexibility to swap underlying models. “Model evaluation: that’s where people are going next,” says Mauny.

Experience What AI-Readiness Means in Stockholm

Many of the aforementioned roadbumps have to do with a lack of AI-readiness, which Mauny credits as important to assess before diving into things like exposing internal APIs and microservices with MCP and letting agents run free.

At Nordic APIs Summit 2026, speakers like Mauny will go into far more detail on how they’re guiding organizations to get the most out of agentic AI while curtailing the downsides. Mauny, who has spoken at Nordic APIs before, also shared some of what she’s looking forward to at the event. “It’s my 2nd Summit and I’m looking forward to going back to Stockholm, a city I really enjoy visiting.”

“I’m excited to connect with friends, including Kin Lane, Lorna Mitchell, Erik Wilde,” says Mauny. “It’s the good ol crew that’s been working together in the same circles for years. I’m also looking forward to meeting Lin Sun, she’s an amazing speaker known for giving impressive live demos.”

She’s also excited to see ICA Gruppen, Sweden’s largest grocery retailer and WSO2 customer, present their AI journey and showcase their use of WSO2 in practice.