How we hacked YC Spring 2025 batch’s AI agents
summary
Hacked 7 of 16 publicly accessible YC Spring 2025 agents within 30 minutes each by extracting system prompts (asking “what tools do you have”) and chaining three recurring flaws: insecure direct object reference where identifier-based tooling exposed user messages and documents; fragile custom code sandboxes that accept injected comments and grant arbitrary code execution leading to cloud token discovery and DB access; and SSRF-style requests that forward repo credentials, leaking entire source trees. Fixes: enforce row-level authorization, use vetted sandboxes, and sanitize forwarded requests.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker intro
- 1:12About Kira and agent security
- 4:43Why hack AI agents
- 6:48First vulnerability: Insecure direct object reference
- 11:03Second vulnerability: Bad code sandboxes
- 17:05Third vulnerability: Server-side request forgery
- 19:33Key takeaways and closing
related talks
18mHow we hacked YC Spring 2025 batch’s AI agents
42mSecuring AI Agents...
46mNot My Vibe: When AI Coding Agents Go Off the Rails
43mLive hacking: Breaking into your Java web app
29mBuilding a Hackbot: How Ethiack's Hackian Finds Real Vulnerabilities
36mAgentic AI Under Attack: Live Demos of Exploits Through Autonomy and Trust
21mHow to hack an Angular app?
30mHow to hack an Angular app?