Pluto Security Raises $42M and Reports Live Attacks in Every Enterprise AI Audit

Pluto Security stepped out of stealth at TechCrunch Disrupt 2026 on Tuesday with $42 million in funding and a disclosure that stopped enterprise security professionals short: in every proof-of-concept audit the company has conducted since it began selling in April, it found malicious components already active inside the customer's AI tool stack. In several cases, those were not dormant artifacts but live attacks underway. "There was not one POC in which we entered and didn't find malicious stuff," CEO Shahar Bahat told TechCrunch.

The company raised an $8.5 million seed round led by TLV Partners, with co-founders of enterprise security firm Armis also investing. Jump Capital led the $34 million Series A, with Shlomo Kramer's Skinos and Ansa Capital participating. Pluto reports more than 30 enterprise customers — including Oscar Health, Workato, Sixt, and AlphaSense — and crossed $2 million in annual recurring revenue in roughly six months of selling. The company employs 40 people across the United States and Israel.

The Invisible Layer: Why Traditional Security Tools Cannot Watch AI Agents

The fundamental problem Pluto is addressing is architectural, not merely procedural. When an enterprise deploys an AI agent — whether a purpose-built system running on Claude or GPT-4, or an employee's no-code automation built over a lunch break — that agent operates inside the model's inference loop. It reads data, calls external APIs, writes files, sends messages, and requests permissions, all as outputs of a language model rather than as programs executing traceable system calls. Existing endpoint detection and response tools, network security monitors, and SIEM platforms were built to watch human users and deterministic software. They have no mechanism for interpreting whether a model's output constitutes a benign task or an attack-in-progress.

Pluto's approach targets this gap with a two-tier architecture. The company deploys lightweight sensors through existing endpoint security and device management integrations, collecting prompts, running processes, permissions, and prior user behavior from each device. Crucially, it runs a lightweight machine learning model directly on the endpoint — rather than sending raw data to a cloud inference service — to classify agent intent in real time. When an agent begins requesting permissions that exceed what its task requires, or when its behavior pattern deviates from the context established by prior user activity, Pluto can intervene mid-task: either halting the action entirely or injecting a prompt that causes the agent to pause and ask a human for confirmation.

On-device inference means intervention decisions happen in the milliseconds between an agent's decision and its action, without the latency of a cloud round-trip.

Read more: NVIDIA launches open agent safety platform to contain AI agents in hardware

Vibe-Coded Apps Are Generating More Risk Than Developer-Built Agents

Perhaps the most counterintuitive finding from Pluto's deployment data is where enterprise AI risk actually originates. The company reports that approximately 60 percent of the security risks it detects across customer environments come from tools built not by the engineering team, but by non-technical employees — finance staff, marketers, and legal professionals using no-code builders and AI-assisted development environments to automate their own workflows.

Developers rank fourth as a source of AI risk in Pluto's customer data.

The mechanism is straightforward: a finance analyst builds a customer management app using Claude or a no-code automation platform, routes it through corporate credentials, and leaves it exposed to the internet without authentication. Pluto documented exactly this at a Fortune 500 company — a finance employee's vibe-coded app connected to customer data sat on the open web, undetected by the existing security stack.

Bahat frames this as a fundamental shift in who needs security governance: "We're moving from user behavior to agent behavior." The traditional security perimeter assumed that humans interacting with systems could be monitored by watching their logins, file accesses, and network connections. AI agents that act autonomously on behalf of humans — and apps that employees build in minutes with no security review — dissolve that assumption.

Independent research corroborates the scale of the problem. An analysis by Noma Security found that a typical enterprise environment connects well over 100 high-risk tools to its AI agents. A distinct structural vulnerability concerns the difference between MCP (Model Context Protocol) servers and AI Skills: MCP servers expose deterministic, loggable function calls that defenders can monitor, but Skills — instruction text loaded directly into a model's reasoning context — are nearly opaque once loaded, creating what researchers call an "observability gap." Because some widely used MCP servers are pinned to @latest, they can silently pull new package versions on every agent load, creating a supply-chain vector that requires no action by the attacker.

A Crowded Category With One Distinguishing Variable

Pluto enters a market that drew $435 million in disclosed investment during the first nine months of 2026. Zenity raised $125 million in a Series C led by Norwest, with SoftBank Vision Fund 2 participating; Alice (formerly ActiveFence) raised $140 million and is approaching $100 million in annual recurring revenue. WitnessAI took in $58 million, and AIR raised $50 million to focus on pre-runtime vetting of the skills and plugins agents use before they are deployed.

What separates Pluto's positioning from most of the category is the explicit focus on the vibe-coding risk vector. Most competitors target enterprise-built agents or specific protocol layers; platforms like AIR concentrate on what happens before an agent runs, while Zenity focuses on monitoring post-deployment enterprise agents. Pluto's coverage of the informal, employee-built AI application layer — the app a non-technical employee built yesterday and connected to production data — addresses a surface most enterprise security teams have not formally scoped, in part because there was previously no tooling to cover it.

The company's free Plutonium tool, an MCP scanner and verified-component catalog available since April, gives Pluto a community development channel that doubles as a lead-generation funnel: Bahat reports thousands of security professionals using it, and the inbound pipeline it generates represents 70 percent of the company's current sales opportunity.

Pluto's founders bring credentials that carry weight in enterprise security procurement. The company was built by veterans of Unit 8200, Israel's signals intelligence unit, as well as Microsoft and Palo Alto Networks. It has also secured partnerships in the accelerator programs of AWS, CrowdStrike, and NVIDIA.

An Audit Statistic That Demands a Security Response

What the Pluto announcement makes difficult to ignore is the 100 percent POC malicious rate. The company is not reporting that it found malicious components in some audited environments, or a concerning percentage. It found them in all of them — including active live attacks, not merely dormant risk artifacts. Even accounting for selection bias (enterprises that engage with a security vendor may be more likely to have detectable problems), the finding suggests that enterprise AI deployment has outpaced enterprise security readiness at a systemic level, and that the missing controls are not edge-case safeguards but foundational.

Gartner has projected that more than 40 percent of agentic AI projects will be cancelled by the end of 2027, citing inadequate risk controls among the primary causes. Whether that outcome reflects deliberate caution or compelled retreat from a threat environment companies cannot manage with existing tools may depend substantially on how quickly the category that Pluto represents matures. With $42 million and evidence of real-world attacks already embedded in its customers' environments, the company now faces the harder question: whether security teams can close an observability gap that is widening faster than any single vendor can cover it.