How we hacked YC Spring 2025 batch’s AI agents
summary
Casco reports they compromise 7 of the 16 agents in YC X25, each within 30 minutes, leaking user system prompts and emails, executing arbitrary code to overwrite sandbox app.py and extract service tokens, and querying BigQuery to access customer data. Exploits include IDOR via exposed IDs, SSRF pulling private GitHub repos and credentials, and arbitrary code execution through writable execute endpoints. Fixes include strict authenticate+authorize checks, role-level access control, and using hardened, firecracker-backed sandboxes instead of homegrown runtimes.
AI-written summary · about
chapters (9)
- 0:00Introduction to Casco and AI Agents
- 1:31Evolution of Agent Stacks and Security Concerns
- 2:56Why Casco Hacked AI Agents
- 4:00Common Issue 1: Cross-User Data Access (IDOR)
- 7:38Common Issue 2: Arbitrary Code Execution
- 12:38Common Issue 3: Server-Side Request Forgery (SSRF)
- 14:48Key Takeaways
- 15:28Casco's Solution and Contact Information
- 15:56Q&A
related talks
23mHow we hacked YC Spring 2025 batch’s AI agents
46mNot My Vibe: When AI Coding Agents Go Off the Rails
42mSecuring AI Agents...
43mLive hacking: Breaking into your Java web app
45mPwning and Defending AI Agent Code Interpreters (Kinnaird McQuade)
51mDefensive Coding Bootcamp
33mAgentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents
34mHijacking Google’s CI/CD Through Prompt Injection:The New Era of AI-Based Exploits