BreakMyAPI: AI-Powered Adversarial Security & Load Testing

Standard API load testing tools (like JMeter or k6) rely on static request payloads. They measure performance but completely miss logical bugs, unhandled exceptions, and security vulnerabilities that only occur with complex, malformed inputs or specific state sequences.

Writing test scripts for every endpoint, query parameter, and payload schema in a large-scale application is incredibly tedious and frequently becomes outdated as APIs evolve.

I am building BreakMyAPI, an autonomous system that auto-generates attack scenarios, detects vulnerabilities, and stress-tests APIs without manual test scripting:

• Adversarial Attack Generation: Uses LLMs to dynamically generate mutation test scenarios, boundary payloads, and logical injection attacks based on parsed API schemas.
• Job Queues via BullMQ & Redis: Manages high-throughput concurrency, test scheduling, and worker dispatching to execute stress-testing processes reliably.
• Cost-Aware Architecture: Enforces strict rate limits, quota controls, and infrastructure caps to prevent uncontrolled scaling and compute costs during fuzzing.

A primary engineering challenge is preventing the agent from triggering destructive cascade failures in test environments (e.g. deleting all reference records in a database in step 1, which invalidates all subsequent read/write tests).

The roadmap features a State Dependency Graph. The testing agent maps routes based on HTTP methods (e.g. POST before PUT, and DELETE strictly at the end of a session flow) and utilizes database transactions that automatically rollback at the end of each test thread.

We are also designing a feedback loop that evaluates API responses (like 500 Internal Server Errors) and instructs the agent to narrow down the fuzzing payload on that specific path to pinpoint the code-level unhandled exception.