AgentsAutonomy & tool use
Pluto Security emerges from stealth with $42M to monitor the AI tools and agents employees use and build
Pluto Security has raised $42 million in seed and Series A funding for endpoint software that tracks the AI tools, extensions, MCP servers and agents employees use or build, and can block risky agent actions and credential access.
From the TechCrunch AI article of October 13, 2026 and cited sources: The funding combines an $8.5M seed round led by TLV Partners and a $34M Series A led by Jump Capital, with Skinos and Ansa Capital also participating. [1] [4]
SOURCES[1] Pluto Security raises $42M as AI gives enterprise security… techcrunch.com[4] Investing.com/FinanceWire press release investing.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- The funding combines an $8.5M seed round led by TLV Partners and a $34M Series A led by Jump Capital, with Skinos and Ansa Capital also participating. [1] [4]
- Original source
- TechCrunch AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 13, 2026 article published
- Covered
- Oct 14 edition
- Evidence
- 7 sources across 6 sites
- 1Pluto Security raises $42M as AI gives enterprise security…techcrunch.com
- 2TechCrunch: Why VCs are betting big on AI security…techcrunch.com
- 3Pluto blog: Introducing Plutoniumpluto.security
- 4Investing.com/FinanceWire press releaseinvesting.com
- 5Plutonium skill pageplutonium.pluto.security
- 6CyberDesserts: AI agent security risks 2026blog.cyberdesserts.com
Reach: not measured yet
The funding combines an $8.5M seed round led by TLV Partners and a $34M Series A led by Jump Capital, with Skinos and Ansa Capital also participating. Together the two rounds total $42.5M. Pluto says it began selling in April 2026 and has passed $2M in annual recurring revenue. [1] [4]
CEO Shahar Bahat says about 60% of the AI-tool risks Pluto detects come from apps built by non-developers. Finance staff create the most, then marketing and legal, with developers fourth. These figures are vendor-reported and drawn only from Pluto's own customers. [1]
Pluto installs sensors on devices, either directly or through existing endpoint and device-management systems. Small on-device models read prompts, commands, processes and permissions to judge what an agent intends to do. The system can then block an action, or insert instructions telling the agent to ask the user for confirmation. Those inserted instructions can guide an agent but cannot force it to comply, and no evaluation of this approach has been published. [1] [4]
Skills, extensions and MCP servers are becoming a supply-chain attack surface. Pluto counted 179 MCP deployments open to the internet, 147 of which accepted requests without authentication. A secondary roundup cites other research: Antiy CERT confirmed 1,184 malicious skills on OpenClaw's ClawHub marketplace, and Trend Micro found 492 MCP servers with no client authentication. [3] [6]
researchers outside Pluto have documented agent extensions and MCP servers as an attack surface.
Read the full assessment
Implication: if Pluto's department pattern holds more widely, companies should inventory and control AI tools in finance, marketing and legal, not only in engineering.
Status: research done, now writing the dossier.
Executive brief
Pluto Security came out of stealth on October 13, 2026 with $42 million in funding. The headline finding is about who creates AI risk inside companies. CEO Shahar Bahat says about 60% of the AI-tool risks Pluto detects come from apps "vibe-coded" by people who aren't developers. Finance teams produce the most, then marketing and legal. Pluto says it started selling in April 2026 and has passed $2M in annual recurring revenue (ARR). It is one of several funded startups whose pitch is that existing security tools can't watch what AI agents do (TechCrunch).
Read the full section
Pluto Security came out of stealth on October 13, 2026 with $42 million in funding. The headline finding is about who creates AI risk inside companies. CEO Shahar Bahat says about 60% of the AI-tool risks Pluto detects come from apps "vibe-coded" by people who aren't developers. Finance teams produce the most, then marketing and legal. Developers rank fourth. Pluto says it started selling in April 2026 and has passed $2M in annual recurring revenue (ARR). It is one of several funded startups whose pitch is that existing security tools can't watch what AI agents do (TechCrunch).
What changed and event timeline
Investors pile into shadow-AI security
Witness AI raised $58M on a claimed 500%+ ARR growth. It is an earlier example of funding for tools that monitor unapproved AI use at work ().
Pluto starts selling
Bahat says commercial sales began this month. TechCrunch also dates the launch of Plutonium, Pluto's free risk-check hub, to April ().
Plutonium blog launch
Pluto's own post introducing Plutonium is dated June 17. The post describes risk catalogs for AI assistant add-ons and a vetted marketplace ().
$42M from stealth
The money is an $8.5M seed led by TLV Partners plus a $34M Series A led by Jump Capital, with Skinos and Ansa Capital participating (;).
Capabilities and access
- What it is: a "workspace security" product delivered through endpoint sensors. It is not an AI model, so there is no model version.
- What it monitors: the AI tools employees use. And the apps and agents employees build (TechCrunch).
- Enforcement: it can block malicious skills, restrict unsafe agent actions and stop agents from reaching credentials (press release).
Read the full section
- What it is: a "workspace security" product delivered through endpoint sensors. It is not an AI model, so there is no model version.
- What it monitors: the AI tools employees use; the skills, extensions and MCP servers those tools depend on (MCP is a standard protocol for connecting AI assistants to outside tools and data); and the apps and agents employees build (TechCrunch).
- Enforcement: it can block malicious skills, restrict unsafe agent actions and stop agents from reaching credentials (press release).
- Free tier: Plutonium offers risk catalogs, an MCP scanner, a catalog of verified components and a scanner "skill" that runs inside an AI assistant (Plutonium).
- Paid product: enterprise only. No public pricing.
Technical analysis for researchers and developers
- Deployment: Pluto connects to existing endpoint security and device management systems and installs its sensors through them, or directly on devices.
- Signals collected: prompts, commands, running processes, permissions and each user's past activity.
- In-session intervention: if an agent tries to take more permissions than the user intended, Pluto can stop the action or inject instructions into the agent's session telling it to ask for confirmation.
Read the full section
- Deployment: Pluto connects to existing endpoint security and device management systems and installs its sensors through them, or directly on devices.
- Signals collected: prompts, commands, running processes, permissions and each user's past activity. Small "lightweight" models running on the device judge what an agent is trying to do (TechCrunch).
- In-session intervention: if an agent tries to take more permissions than the user intended, Pluto can stop the action or inject instructions into the agent's session telling it to ask for confirmation.
- Catch: injected context can steer an agent but cannot force it. Whether it works depends on the model following the instructions, and no evaluation of this has been published.
- Marketplace vetting: listings are judged against eight principles, including privilege scoping, reproducible behavior and the ability to inspect the code. No catalog size or false-positive rate is disclosed (Pluto blog).
Claims and evidence
- Risk sources: the 60% non-developer share, the ranking by department, and the claim that a new AI tool appears inside customer environments within two hours of release all come from Bahat.
- Proof-of-concept trials: Bahat says every trial found malicious extensions or skills, and some found attacks in progress. The details are anecdotal.
- Traction figures don't match:
Read the full section
- Risk sources: the 60% non-developer share, the ranking by department, and the claim that a new AI tool appears inside customer environments within two hours of release all come from Bahat. They describe Pluto's own customer base and have not been audited (TechCrunch).
- Proof-of-concept trials: Bahat says every trial found malicious extensions or skills, and some found attacks in progress. The details are anecdotal.
- Traction figures don't match:
- TechCrunch reports 30+ customers and 40 employees.
- The press release says 40+ customers, 50+ employees and more than 1 million endpoints secured (press release).
- The two disclosed rounds add up to $42.5M, not $42M.
- Exposed MCP servers: Pluto says it found 179 MCP server deployments open to the internet, 147 of which accepted requests without authentication (Pluto blog).
Context and prior work
Third-party research describes the same threat. A secondary roundup cites: The Cloud Security Alliance has published notes on supply-chain trust for agent skills and on a spec for scanning MCP servers (CSA). Competing startups include Witness AI ($58M) (TechCrunch).
Read the full section
Third-party research describes the same threat. A secondary roundup cites:
- Antiy CERT confirming 1,184 malicious skills on OpenClaw's ClawHub marketplace.
- Trend Micro finding 492 MCP servers with no client authentication.
- BlueRock Security finding 36.7% of 7,000+ MCP servers vulnerable to server-side request forgery (SSRF) (CyberDesserts).
The Cloud Security Alliance has published notes on supply-chain trust for agent skills and on a spec for scanning MCP servers (CSA). Competing startups include Witness AI ($58M) (TechCrunch).
Limitations, safety and contested findings
- No independent test of how well Pluto detects threats, how often it raises false alarms, or how much load its sensors add to devices.
- Collecting prompts and command histories from endpoints is itself sensitive. The sources do not describe how Pluto retains or governs that data.
- The dates and traction numbers disagree between TechCrunch and Pluto's own materials (see above).
Read the full section
- No independent test of how well Pluto detects threats, how often it raises false alarms, or how much load its sensors add to devices.
- Collecting prompts and command histories from endpoints is itself sensitive. The sources do not describe how Pluto retains or governs that data.
- The dates and traction numbers disagree between TechCrunch and Pluto's own materials (see above).
- The Fortune 500 finance app left exposed to the internet is a single unnamed case.
Business and practitioner implications
- If Pluto's pattern holds, finance, marketing and legal staff building their own AI apps are a larger exposure than developers.
- Treat skills, extensions and MCP servers as supply chain. Pin versions, review permissions and require authentication on remote MCP servers.
- Buyers: in a pilot, ask for detection rates measured on your own environment, and ask how well the inject-instructions approach holds up against each AI model you use.
Read the full section
- Look past engineering. If Pluto's pattern holds, finance, marketing and legal staff building their own AI apps are a larger exposure than developers. AI-tool inventories should cover those teams.
- Treat skills, extensions and MCP servers as supply chain. Pin versions, review permissions and require authentication on remote MCP servers.
- Buyers: in a pilot, ask for detection rates measured on your own environment, and ask how well the inject-instructions approach holds up against each AI model you use.
- Market: Pluto's go-to-market relies on a free community tool. It says 70% of its sales pipeline is inbound, without saying how much comes from Plutonium.
The source trail.
Sources (7)
Pluto Security raises $42M as AI gives enterprise security teams a new headache
Article text retrieved; extracted text may omit tables or interactive elements.
techcrunch.com