World's Fair 2025
How we hacked YC Spring 2025 batch’s AI agents — Rene Brandel, Casco
Overview
This talk explores common security vulnerabilities found in AI agents by detailing a process of "hacking" Y Combinator batch AI agents. The core thesis is that agent security extends beyond traditional LLM prompt injection to encompass broader system-level risks, emphasizing the need to treat agents with the same security considerations as human users and to avoid building custom code execution environments.
Who should watch
- AI Engineers
- Product Managers building AI products
- Developers working with AI agents and tool integrations
- Security professionals focused on AI systems
- Anyone concerned with the robustness and safety of AI applications
Key takeaways
- AI agents should be treated as users, meaning they require similar authentication, authorization, and input/output sanitization as human users.
- Cross-site data access vulnerabilities are prevalent, often stemming from insecure direct object references (IDOR) where user IDs or other identifiers are guessable or exposed.
- Code execution environments used by agents are a significant attack vector; developers should avoid building custom sandboxes and instead use robust, out-of-the-box solutions.
- Server-side request forgery (SSRF) can occur when agents are allowed to call unintended endpoints, potentially exposing sensitive credentials or internal system information.
- *Agent security is bigger than just LLM security.* Understanding how threat vectors apply across the entire system is crucial.
- Developers often fall into the trap of giving agents service-level permissions, when they should be treated with user-level constraints.
- *Don't roll your own code sandboxes; it's very dangerous.* Custom solutions are prone to lateral movement across infrastructure and credential exposure.
Notable quotes
Rene Brandel: Agent security is bigger than just LLM security.
Rene Brandel: Treat agents as users.
Rene Brandel: Definitely don't roll your own code sandboxes. That is just so dangerous.
Unofficial community note. Prefer the recording for nuance.