From Schema to Shell: The Agentic Exploitation of GraphQL APIs

No ratings

Presented at BSides Toronto 2026 by

Aleksa Zatezalo

GraphQL's flexibility creates an attack surface traditional scanners weren't built for. GrapeQL is a modular GraphQL security platform that covers the full kill chain: fingerprinting the engine, probing for injection, auth bypass, IDOR, and DoS, then handing confirmed findings to an AI agent that produces a vulnerability report along with working exploit scripta. The platform ships as a browser-based tool. Upload or edit YAML test cases directly in the UI, point it at an endpoint, and let it run. When a finding lands, click Exploit — the agent probes the vulnerable query or mutation with tailored payloads and emits a self-contained Python script you can download and run. It will be demo this live against a deliberately vulnerable GraphQL API, covering SQLi, command injection, and DOS attacks. The talk is honest about where agentic generation earns its keep (injection chains, auth bypass) and where it doesn't (blind OOB, complex fragment bombs). If you're securing GraphQL APIs — or building tools for people who do — this is the architecture walkthrough you want.