API-only access is a deployment model where an AI system is exposed through a controlled interface, such as a web service or application programming interface, instead of distributing the underlying model weights, code, or training data. Users can send prompts and receive outputs, but they cannot inspect internal parameters, change safety filters, or independently run the model.
This matters in cyber security because it changes the balance between convenience, control, and trust. Defenders may prefer API-only access to limit model theft, reduce unauthorized modification, and keep abuse monitoring centralized. Attackers may target the API itself with prompt injection, rate-limit evasion, account abuse, or data exfiltration attempts, even when the model remains closed. The tradeoff is that external teams cannot fully verify safety claims, test edge cases end to end, or audit how the system behaves under pressure. In practice, API-only access is useful for managed deployment, but it is not the same as open or inspectable access.