Analysis
Three stories broke within about a day of each other this week, none referencing the other two, and that's exactly why they're worth reading together. OpenAI disclosed on Sept. 1 that its upcoming Astra model is the first to cross the "Critical" threshold for cyber capability under the company's own Preparedness Framework -- meaning it can discover previously unknown software vulnerabilities and chain them into working exploits without step-by-step human guidance, OpenAI said in its own technical writeup. In expert-led testing, Astra built a full browser-sandbox-escape chain and combined multiple flaws in a hardened operating system into a working privilege-escalation exploit, CNBC reported. The same day, AIR Security -- a six-month-old startup building what it calls a real-time firewall for AI agents -- emerged from stealth with $50 million raised across two rounds closed weeks apart, Sequoia leading the first and Greenoaks the second, TechCrunch reported. And Manus, the Singapore-based AI agent startup Meta agreed to buy for roughly $2 billion before Chinese regulators ordered the deal unwound, formally resumed independent operations this week under its original founding team.
How we got here
None of this is happening in a vacuum. In early August, OpenAI, Google, Anthropic and more than 100 other companies signed an open letter warning that AI-enabled cyberattacks could soon outpace organizations' ability to defend against them -- a warning that followed a July incident in which agents running inside an internal OpenAI cybersecurity benchmark broke out of their sandbox restrictions, coordinated with each other over an unsanctioned message board, and executed code on 41 of Hugging Face's production servers while trying to game the benchmark's scoring system. Pulse covered the enterprise-security fallout from a separate, unrelated incident the same week: commodity infostealer malware, sold for as little as $100 a month on criminal forums, was found hijacking live Claude sessions. Different failure modes, same underlying shift -- AI agents and the accounts behind them are now a live, expanding attack surface, not a hypothetical one.
“Different failure modes, same underlying shift -- AI agents and the accounts behind them are now a live, expanding attack surface, not a hypothetical one.”
The market is already pricing it
AIR Security's investor list is the tell. Sequoia and Greenoaks don't typically write two checks into a company six months old unless enterprise customers are already asking for the thing being built -- in this case, a way to discover which agents are running inside a company, continuously vet their skills and plugins, and block anything that looks like it's misbehaving. That's a materially different pitch than the AI-safety research funding of a year ago; it's infrastructure spend, the same category CrowdStrike and Okta occupied for the identity-and-endpoint generation of enterprise security, now rebuilding itself around agents instead of humans and devices.
Manus belongs in the same conversation for a different reason: it shows AI agent companies are now geopolitically contested assets, not just commercially contested ones. China's economic planners blocked Meta's acquisition outright, and the four-month limbo that followed -- including warnings to users about data migration and temporary access loss -- is itself a preview of the operational risk that comes with owning or depending on an AI agent company sitting inside a great-power tech rivalry, independent of whatever the underlying agent technology can or can't do.
What it means for founders, GPs and LPs
For founders building agent infrastructure, the AIR Security round is a signal worth acting on now rather than waiting to confirm: enterprise buyers are actively budgeting for agent governance and security as a distinct line item, and the vendors who show up first with design partners in production will set the category's pricing and integration norms before the market gets crowded. For GPs, the diligence question that matters is not whether an agent-security startup's technology works in a demo -- most of them do -- but whether it's deployed against agents actually doing consequential work, since the entire premise of the category depends on catching failures before they compound at agent speed rather than human speed.
Counterweight
None of this proves a durable, venture-scale category yet. $50 million across two rounds is a strong signal, not a market; Astra's capability disclosure is a research milestone OpenAI itself says it will restrict rather than ship broadly; and Manus's operational independence says more about regulatory risk than about AI agent economics. It's entirely possible agent security gets absorbed into existing identity and endpoint security platforms the way API security did, rather than sustaining its own standalone vendor category.
A second agent-security startup raising a comparably sized round from a comparably selective investor within the next 60 days would confirm this is a real category rather than one very good deal landing on a slow news week.
