Why Your Deprecated Endpoints Are an Attacker’s Best Friend: The Rise of Ghost APIs

This report describes the systemic risk posed by "Ghost APIs"—deprecated endpoints that remain accessible in production and bypass modern security controls—illustrating how archived documentation, hardcoded credentials, and LLM-assisted reconnaissance enable attackers to discover and exploit these interfaces (with real-world examples such as the Optus and T-Mobile incidents). It outlines attacker techniques and provides three practical mitigations (traffic analysis via service mesh, temporary disabling/scream testing, and short-lived identity-scoped tokens) plus a call for operationalizing enforced deprecation and lifecycle management.