Rene Brandel is the co-founder and chief executive of Casco, which uses autonomous security testing to find vulnerabilities in applications, cloud infrastructure, APIs, and AI agents. His central concern is what happens when agents receive powerful tools and service credentials without the access controls that should constrain the people using them.
In 2016, Brandel helped create Ivy, a conversational website-building project that won HackZurich. It combined services including IBM Watson and Microsoft LUIS to generate websites from spoken instructions, anticipating later natural-language coding tools.
At Microsoft, he worked on the Skype team in Prague and helped develop Skype Interviews, which combined Skype and Visual Studio for technical interviews. His team also created a meeting-scheduling product. At Amazon Web Services, he worked on developer tools involving authentication, authorization, GraphQL, databases, real-time applications, and AI agents. In May 2024, he co-authored the launch of AWS Amplify Gen 2, which let developers define application backends, authentication, data models, and cloud resources in TypeScript.
Brandel subsequently co-founded Casco with Ian Saultz; the company joined Y Combinator’s Spring 2025 batch. Their early agentic red teaming of fellow startups’ products exposed vulnerabilities in seven of sixteen agents during tests limited to approximately thirty minutes per system. The resulting failures included cross-account data exposure, unsafe code execution, and compromised credentials. His account of those attacks reframed agent security as an application and infrastructure problem, not simply a question of prompt injection.
How Brandel thinks about agent security
- Agents should inherit the user’s permissions. Authenticating a request does not establish permission to access a particular document, conversation, or account. Brandel advocates explicit ownership checks, separate authorization decisions, and row-level security to prevent agents operating with unrestricted service-level privileges.
- The attack surface extends beyond the model. A coding tool permitted to read and write files can potentially overwrite its own safeguards, discover adjacent services, misuse cloud credentials, and reach customer databases. Another failure mode allows an attacker-controlled URL to capture credentials attached to outbound requests. His AI Engineer World’s Fair talk traces these compromises across tools, APIs, execution environments, and infrastructure.
- Untrusted code requires real isolation. Brandel recommends established sandboxing systems, restricted networking, short-lived execution environments, and stronger isolation mechanisms such as Firecracker-based microVMs. Ordinary containers and improvised application-level checks should not be mistaken for sufficient security boundaries.
- Security findings need context and a path to remediation. His work on automatic context-refinement loops incorporates application-specific explanations for dismissed findings to reduce recurring false positives. The Casco MCP server gives existing coding assistants OAuth-authenticated, read-only, organization-scoped access to validated vulnerabilities so developers can investigate and fix them within familiar workflows.
Brandel has also addressed MCP tool poisoning, disclosed an ElectricSQL database vulnerability, and supported the OWASP AI Exchange. His larger goal is self-securing software, with vulnerability discovery, validation, and remediation integrated continuously into development.
