My slides for my keynote 'How AI Agents Change API Interaction'

Bill Doerrfeld | October 18, 2026

Here are my slides for my opening keynote at Nordic APIs Summit 2026:

Download a PDF of my slides

About the talk: 'How AI Agents Change API Interaction'

At Nordic APIs Summit 2026, I opened up the event with a keynote on how AI agents are forcing major shifts in how they interact with APIs. In the 25 minute talk, I outlined six signifcaint changes.


How Six Patterns Are Changing


Discovery


For one, discovery is completely changed — since agents find APIs on the fly at runtime. I compared it to Neo in The Matrix's famous line, "I know kung fu." Similarly to getting supercharged with knowledge, agents discover your APIs instantly. This is compared to the hours, days, if not weeks, discovery pipeline of yesteryear.


Requests


Secondly, the actual process of mechanically constructing requests is changing. Whereas developers build off the docs or previous knowledge, agents often make assumptions on how APIs should look based on their training data and how, in general, they think the "standard" API should look and behave.


Traffic


"I get knocked down, but I get up again, you're never gonna get me down..." It sure sounds like Chumbawamba was an AI agent. Because these tenacious lil buggers routinely retry, retry, retry until they are unblocked. The traffic change is obvious when you see the cloud bills escalating in the agentic era.


Predictability


A big shift is underway — we're moving from deterministic software to non-deterministic LLM-based software. It's a big sea change, and when API workflows are in the mix, it means they don't look the same twice. I compared it to your typical ramen microwavable bowl, where you always know what you're going to get, with a bowl of ramen made by a chef using whatever's in the kitchen. It'll be valid, but different each time.


Capabilities


We've been discussing capabilities a lot in the API industry this year. And for a good reason. Agents like highly scoped tools to consume that are built around business use cases. I compared the context that you need to supply to agents to the VHS video that Drew Barrymore's character Lucy plays in 50 First Dates — all they know is what's in the context window — the tape you play them.


Security


Lastly, the way we secure access is probably the most significant shift when agents are invoked. You can't just say "don't touch production" — agents need guardrails that live outside of the prompt and at a more base level. Without it, it's like boldly going out on a NYC street with a 100-dollar bill in your pocket and saying, "Please don't take it." Agents have no morals or ethics! At the API level is where access determination, just-in-time, and least privilege need to exist.


The Best of Times, the Worst of Times


My keynote opened with a stark quote from Charles Dickens' A Tale of Two Cities: "It was the best of times, it was the worst of times."


I chose to focus on this paradox because that's what it feels like in AI right now. People have unprecedented freedom to build whatever their heart desires. But this comes with security vulnerabilities, uncertainty in the market, ethics concerns, environmental impacts, AI slop, and so much more.


I think APIs stand right in the middle of all of this — and getting them and agentic consumption right could go beautifully right or beautifully wrong.


More From the Experts Incoming


My keynote offers some hints on what to do — prepare for error messages, document in a machine-readable way, make your specs discoverable, prepare for funky traffic patterns, and more.


But it'll take the experts to dive deeper into all these themes. Thankfully, we recorded some amazing talks at Nordic APIs Summit, which will be posted to the Nordic APIs YouTube soon.

Other Blog Posts

By Bill Doerrfeld • October 17, 2026
My latest research for AI Security University looks at AI tools and resources for pen-testers, red teamers, and bug bounty hunters.
By Bill Doerrfeld • October 16, 2026
My commissioned feature for Arthur D. Little's PRISM publication analyzes the big shifts underway now that generating code is becoming trivial.
By Bill Doerrfeld • October 11, 2026
Was happy to participate as a speaker and moderator at SecureMaine on October 8th, 2026.
By Bill Doerrfeld • October 5, 2026
My latest for LeadDev interviews a Meta engineer who built an agentic system to optimize their capacity planning, leading to real power use savings.
By Bill Doerrfeld • September 30, 2026
I set out expecting to write an article about how every enterprise was jumping on trendy alternative or "neo" clouds. That ended up not being the case.
By Bill Doerrfeld • September 28, 2026
Join the virtual AI Pen-Testing Conference to explore how AI is changing penetration testing, red teaming, and the security testing of AI systems.
By Bill Doerrfeld • September 28, 2026
Counting down to Nordic APIs Summit 2026 in Stockholm, featuring 60+ speakers exploring agentic AI, APIs, MCP, and security.
By Bill Doerrfeld • September 28, 2026
I covered a Yale and GitHub report on LeadDev that explores developer attitudes on climate change and curbing IT waste.
By Bill Doerrfeld • September 15, 2026
Does your agent really need access to every tool call under the sun?
By Bill Doerrfeld • September 8, 2026
I'll be writing a weekly series for The New Stack this fall covering Kubernetes, cloud native, and everything happening on the road to KubeCon in November.