# How We Hacked YC Spring 2025 Batch's AI Agents

Rene Brandel, Casco | AI Engineer World's Fair 2025 | 17:33

Source: https://www.youtube.com/watch?v=kv-QAuKWllQ
Channel: AI Engineer (https://www.youtube.com/@aiDotEngineer). Summarised by AIE Talks.
Page: https://aietalks.com/talks/how-we-hacked-yc-spring-2025-batchs-ai-agents
Published: 2025-07-30
Tags: guardrails, security

## TL;DR
- Agent security includes the web application and infrastructure around the language model, not only prompt injection and harmful outputs.
- Agents should have user-level permissions, with authentication, authorization, and input and output sanitization applied to them.
- Custom code sandboxes can let an attacker move from arbitrary code execution to service tokens, internal resources, and customer data.

## Summary
Rene Brandel describes how Casco tested 16 publicly accessible YC X25 AI agents, spending up to 30 minutes on each and successfully hacking seven. The attacks exposed three recurring problems. Insecure direct object references let one user access another user's information by changing IDs and following links between users, chats, and documents. Code execution tools allowed attackers to inspect files, overwrite application code, bypass protections, and discover service credentials. Server-side request forgery let an agent call an unintended private GitHub endpoint and disclose credentials used to download a codebase. Brandel argues that agent security must cover the whole application and its connected infrastructure. Agents should be treated like users rather than trusted services. He advises teams to use established sandbox products instead of building their own Python-based execution systems, and to keep applying established web security practices to agent tools and workflows.

## Key ideas
### Agent security reaches beyond the language model
[01:31](https://www.youtube.com/watch?v=kv-QAuKWllQ&t=91s)
Brandel says agent stacks have become more standardized, with a server front end, an API server, a language model, tools, and connected data sources. That makes systems easier to build, but it also creates more paths for attacks. He argues that discussions focused on prompt injection and harmful content cover only part of the problem. Real damage can come from ordinary errors elsewhere in the system, especially in downstream APIs, permissions, and infrastructure. His examples examine the arrows around the model rather than treating the model as the entire security boundary.

### Seven of sixteen agents had exploitable problems
[02:56](https://www.youtube.com/watch?v=kv-QAuKWllQ&t=176s)
Casco chose publicly accessible agents from the YC batch and limited each test to 30 minutes. The team inspected each agent's system prompt and tool definitions, then tried to use those tools in ways the developer did not intend. Brandel says they hacked seven of 16 agents. The exercise found three recurring issues: cross-user data access, arbitrary code execution, and server-side request forgery. He presents the attacks as short tests that exposed basic application and infrastructure mistakes, rather than as elaborate model exploits.

### IDOR lets attackers traverse connected user data
[04:00](https://www.youtube.com/watch?v=kv-QAuKWllQ&t=240s)
One agent exposed tools for looking up user information, documents, and other records by ID. Casco found a user ID in a product demo URL, changed it, and retrieved another person's personal information, including an email address and nickname. The exposed IDs were connected: a user ID led to a chat ID, which led to a document ID, allowing the team to move through the system. Brandel explains that checking whether a token is valid is authentication, but the application must also check whether that user is allowed to access the requested object.

### Agents need user-level permissions and authorization checks
[06:31](https://www.youtube.com/watch?v=kv-QAuKWllQ&t=391s)
Brandel says developers often give agents service-level permissions because the agent runs on a server. He argues that agents act more like users, so user security rules should apply. The language model should not decide authorization, and an agent should not automatically receive service-level access. Requests need an access-control matrix that matches the requested resource to the identity making the request. Brandel also applies familiar web security practices to agents, including sanitizing inputs and outputs instead of accepting arbitrary values.

### A weak code sandbox can expose the surrounding infrastructure
[07:38](https://www.youtube.com/watch?v=kv-QAuKWllQ&t=458s)
The second attack involved an agent that could write and execute Python files. Casco first mapped the file system, found the application file, and inspected the endpoints that controlled file writing and execution. Although those endpoints were hidden behind a VPC, the team could overwrite the application file and remove its security checks. Once inside the container, an attacker could perform service endpoint and metadata discovery, retrieve a service token, inspect its scopes, and query customer data in BigQuery. Brandel says arbitrary compute creates a path for lateral movement across the infrastructure.

### Server-side request forgery can leak private repository credentials
[12:38](https://www.youtube.com/watch?v=kv-QAuKWllQ&t=758s)
In the SSRF example, an agent could create a database and retrieve its schema from a private GitHub repository. That request needed Git credentials, so Casco supplied a URL pointing to a repository it controlled and observed the credentials sent with the request. Those credentials were then enough to download the company's codebase from the private repository. Brandel uses the example to show why every tool call needs careful review. An agent that can be induced to call an unintended endpoint can disclose credentials even when the endpoint is not directly exposed to the attacker.

### Teams should use established isolation for code execution
[14:48](https://www.youtube.com/watch?v=kv-QAuKWllQ&t=888s)
Brandel's three takeaways are that agent security is broader than language-model security, agents should be treated as users, and teams should not build their own code sandboxes. He calls custom Python sandboxes difficult to secure because code execution can lead to internal network access and service credentials. In the question period, he says products using Firecracker provide a stronger isolation layer than ordinary containers. Containers alone should not be treated as an isolation boundary. Casco offers an AI agent that actively attacks other agents and reports where they fail.

## Notable quotes
- "Agent security is bigger than just LM security." (14:54)
- "Agents actually act like users, not API servers." (06:31)
- "Don't roll your own code sandboxes please." (11:57)
- "If you just use containers, by the way, that's not an isolation layer." (17:16)

## Tools & references mentioned
- Casco
- AWS
- Y Combinator
- YC Spring 2025 batch
- IBM Watson
- Microsoft LUIS
- Anthropic
- Claude
- BigQuery
- GitHub
- Superbase
- HiddenLayer
- Firecracker
- Cursor

## Who should watch
- You are building an agent that can read customer records, call internal APIs, or execute generated code and need to check its permissions.
- Your application uses IDs in URLs or tool arguments and you want a concrete example of how cross-user access can spread through related records.
- You are considering a home-built code execution service and need to understand why ordinary containers are not enough for isolation.

## Related talks

- [Agentic Security: Permissions, Provenance, and the Agent Supply Chain](https://aietalks.com/talks/agentic-security-permissions-provenance-and-the-agent-supply-chain) (Steve Yegge, Gas Town, 22:32)
- [Securing Code-Executing AI Agents](https://aietalks.com/talks/securing-code-executing-ai-agents) (Fouad Matin, OpenAI, 14:00)
- [Securing Agents with Open Standards](https://aietalks.com/talks/securing-agents-with-open-standards) (Bobby Tiernay & Kam Sween, Auth0, 18:41)
- [Security Track Intro](https://aietalks.com/talks/security-track-intro) (Randall Degges, Snyk, 04:16)
- [Agentic Development Security](https://aietalks.com/talks/agentic-development-security) (Ezra Tanzer, Snyk, 27:33)