AI apps are the new honeypot for bot abuse
AI applications have become a prime target for bots and malicious actors, largely because every unauthorized request carries a real cost: the price of an LLM inference. The economics of AI compute have turned these platforms into high-value targets for abuse, and the attack patterns are not hypothetical. Documented incidents on GitHub and other repositories show attackers actively attempting to bypass payment mechanisms to access AI services.
Two attack vectors dominate:
- Denial of Wallet Attacks: Bots flood an application with requests to inflate its operational costs, forcing the target to absorb unwarranted financial burdens.
- Prompt Injection Attacks: Attackers exploit AI applications to generate unintended responses or extract sensitive data from embedded business logic, effectively using expensive AI APIs without bearing the cost themselves.
Vercel's first line of defense is its built-in DDoS mitigation, including the recently launched Attack Challenge Mode. The Vercel Firewall applies L3, L4, and L7 protections, using hundreds of signals to fingerprint request patterns, identify likely attacks, and challenge or block suspicious traffic. But for high-value actions like AI calls, Vercel needed an additional layer of protection on top of that infrastructure.
Inside the AI SDK Playground
The Vercel AI SDK Playground serves as a case study in securing AI workloads. It's a sandbox that lets users experiment with dozens of LLMs in a single dashboard, and it operates a tiered access system—anonymous users up to verified customers. While that structure is useful for legitimate experimentation, it also makes the platform an attractive target for attackers seeking free access to AI models or a way to circumvent geographic restrictions on certain AI technologies.
Initial basic bot protection measures proved insufficient. The attackers' motivations were strong enough that they kept finding workarounds, so Vercel turned to a more sophisticated solution.
Bringing in Kasada
Integrating Kasada's bot protection turned out to be the turning point. Kasada applies a layered defense: client-side protections, AI/ML-based anomaly detection on the server, invisible challenges, and data integrity checks to prevent tampering and replay attacks. The platform is designed to evolve quickly, be difficult to evade, and remain invisible to legitimate human users.
The key enforcement mechanism was a 1st-party-request-only protocol implemented through Next.js Middleware. This setup intercepts bot-driven API calls and blocks or allows them based on Kasada's bot classification.
The results were immediate. Upon deploying Kasada, bot traffic dropped from a staggering 84% of all traffic to negligible levels, while human traffic continued steadily.
How the middleware integration works
The integration itself is straightforward. Kasada's API can be integrated easily, and the enforcement happens in the Next.js middleware layer.
middleware.js
import { NextResponse } from 'next/server';
import { kasada } from '@lib/kasada-api';
export default async function middleware(request) {
const { error, context } = await kasada.classify(request);
// If Kasada was down or another failure occurred, fail open so users aren't impacted
if (error) {
console.error(`Kasada failed open with error: ${error}`);
return NextResponse.next();
}
// If the request is a Bad Bot, block this request and return a customizable response
if (context.response) {
return kasada.prepareResponse(context.response, context);
}
// No Bad bot detected, proceed to the next route handler
return NextResponse.next();
}
Ongoing protection for AI workloads
The Kasada integration exemplifies the broader approach Vercel is taking to secure AI applications: layered protections that span infrastructure-level DDoS mitigation, firewall signals, and application-level bot detection. The AI SDK Playground sees millions of active generations daily, and blocked bot traffic runs at roughly 5x that volume—a clear signal that the protections are working.
The collaboration is part of an ongoing effort. As AI technologies evolve, so do the attack strategies against them, and Vercel continues to iterate on secure access to AI compute for its users. A template is available for developers who want to apply the same protection pattern to their own AI apps.
