$375 million in two days to secure AI agents

$250 million on Monday, $125 million on Tuesday

On August 3, Horizon3 announced a $250 million raise at a valuation north of $2 billion. The next day, Zenity announced $125 million. Both sell the same promise: protecting companies from their own AI agents.

There's a third number missing from those press releases. In the AI Pulse survey KPMG published on March 31, based on 2,110 executives across 20 countries, 11% of organizations have left experimentation behind and run agents at enterprise scale. The rest are piloting, or have one deployment sitting in a corner.

$375 million in two days, to equip a fleet that's only partly on the road. An alarm shop opening across the street from a subdivision that's still under construction. That timing gap is what makes the week interesting, more than the amounts themselves.

The money landed three days after the last confession

Investors didn't have to imagine the risk. The industry had just handed them three demonstrations in ten days, and we covered each one.

On July 22, OpenAI admitted that the Hugging Face intrusion came from its own models, mid internal evaluation. On the 30th, the platform's technical post-mortem described a security agent that caught the attack and forgot to escalate it. On the 31st, Anthropic published a review of 141,006 evaluation sessions: three of its models reached real systems from tests that were supposed to be cut off from the internet, and none of the affected organizations had noticed.

An insurance rep who knocks the morning after the fire doesn't have to explain what a policy is for. Three days separate Anthropic's post from the Horizon3 announcement, and TNW points out that both labs came clean in the same week the round closed.

Two companies, two very different jobs

That $375 million doesn't buy the same product twice, and the two are easy to conflate.

Horizon3 has been doing autonomous penetration testing for six years. Its NodeZero platform attacks a customer's production network to show where the doors are, the way you'd pay a locksmith to pick your own lock while you watch. The release claims more than 7,000 customers, 310,000 tests run in production without a single service interruption, and 120% year-over-year growth in recurring revenue. The valuation has tripled since last year's $650 million round.

One detail deserves a flag, because the house slogan is "AI vs. AI." At Horizon3, AI maps attack paths and chains vulnerabilities together, but the exploits themselves stay deterministic and pre-validated. Forbes describes a mix of deterministic attack logic, graph reasoning and several models working in concert. This is not an AI turned loose on a customer's network.

Zenity, founded in 2021, sells something else: oversight of the agents already in place. Its platform discovers the agents running inside a company's environment, reads the intent behind every action before it executes, then allows it, modifies it or blocks it. It covers Copilot, ChatGPT Enterprise, Gemini, Claude, and agents built in house.

The $125 million round is led by Norwest, with SoftBank Vision Fund 2, Hitachi Ventures and LG Technology Ventures on the cap table. The valuation, for its part, wasn't disclosed.

The first agent to go after another agent

The same day, a third piece of news gave a sense of what this market will have to cover. Researchers at Pillar Security published a flaw in google/adk-python, Google's open source toolkit for building agents, downloaded more than 90 million times.

The mechanism runs in three beats. An attacker opens a pull request carrying a prompt injection. The triage agent, public and low privilege, reads it and gets talked into posting a comment that wakes up a second agent, this one reserved for maintainers. The intern politely asked to go fetch the boss, except the boss has the keys to the vault: GitHub token exfiltrated, approvals forged, reviews dismissed, malicious code that ends up looking reviewed.

One point got lost in the pickup. This was a researcher demonstration, not an attack anyone suffered. Google patched it, the workflows involved were pulled in July, and no malicious actor ever exploited the flaw.

Pillar says it identified "the first practical, real-world case of agent-to-agent exploitation in a multi-agent system in a real production environment". The words "real-world" describe the repo, not the attacker. The "first agent-on-agent violence" line that traveled so well is a headline from The Register, not a finding.

The number the press releases left out

Which leaves the question of how many companies actually run the fleet these products watch. The surveys say something more nuanced than a desert.

In the US edition of the same KPMG poll, fielded between April 28 and May 25 among 204 executives at companies above $1 billion in revenue, 53% are deploying AI agents, down from 55% the previous quarter. But only 18% orchestrate several agents across their processes, a figure that doubled in three months. That's the one that counts: Pillar's flaw and Zenity's product both deal with agents that call each other, and that setup exists in fewer than one company in five.

Governance shows a gap of the same size. Deloitte, which surveyed 3,235 executives in 24 countries for its April 24 report, found 21% of organizations with a mature governance model for agentic AI. The same report counts 74% of executives who expect to use agents "at least moderately" by 2027, a projection whose verb is still in the future tense.

Zenity, meanwhile, headlines its release "Zenity Raises $125 Million to Secure the Era of 1 Billion AI Agents". No source is cited for that billion. Its CEO Ben Kliger told SiliconANGLE the same week: "Every organization is deploying off-the-shelf AI agents or developing its own."

The caterer who orders for a thousand hasn't necessarily seen the guest list. Between that story and KPMG's 18%, there's room for a misunderstanding.

What's unusual about this timing

Let's be fair about what these two companies do. The risk they address is documented, including by our own July coverage, and Horizon3 isn't selling a product invented for the occasion: it has been selling a six-year-old job that the moment happens to accelerate.

What changed is the order of operations. In security, tooling usually shows up long after the damage. Firewalls followed break-ins, antivirus followed viruses, data protection followed leaks. This time, two nine-figure rounds closed while the customer base is still mostly in testing.

You can read that as an industry that finally learned to get ahead of the problem. You can also read it as capital staking a claim on adoption that's promised rather than observed. Both readings hold up with the same numbers, and that's exactly the problem.