AI Agent Security Funding Tops $3.6B as Open Source Lags

The money arrives

Securing autonomous AI agents has quickly become one of the most heavily funded corners of cybersecurity. One aggregation of Crunchbase, CB Insights and Gartner data puts the combined fundraising of the ten leading agentic AI security startups at $3.6 billion. The same analysis counts about $96 billion in cybersecurity M&A, $72 billion of it from just three acquirers 3.

The headline figure hides a lopsided distribution. Cyera accounts for $1.7 billion of the $3.6 billion on its own 3. Further down the list, Noma Security raised $100 million for AI agent hardening, and WitnessAI closed a $58 million round in January backed by Sound Ventures, Qualcomm Ventures and Samsung Ventures, which took its total past $85 million 3. At the bottom of the table, startups focused on the Model Context Protocol (MCP), the plumbing that connects agents to enterprise systems, are still working on seed money. Disclosed MCP security funding totals only $40 million 3.

The pace is still picking up. Reco said it raised $55 million as an extension of a $30 million Series B it announced in February, which brings its total to $140 million 4. AT&T, a Reco customer, invested through its venture arm, alongside Forestay and Quadrille Capital. Chief executive Ofer Klein said the valuation has "more than doubled" since February, putting it loosely in the "high hundreds of millions" 4. The company plans to spend the money on hiring, sales, partnerships and customer support, which points to a land-grab phase rather than R&D 4. TechCrunch's framing that agent security startups are now "crowding the market" fits the data 4.

The threat model takes shape

One reason capital is flowing now is that the risks finally have a shared vocabulary. The OWASP GenAI Security Project announced its Top 10 for Agentic Applications on 9 December 2025. It is a community taxonomy of the most critical risks in systems where agents plan, call tools, keep memory and coordinate with each other 2. The ten categories, labeled ASI01 through ASI10, are:

• Goal hijack
• Tool misuse
• Identity and privilege abuse
• Supply chain vulnerabilities
• Unexpected code execution
• Memory and context poisoning
• Insecure inter-agent communication
• Cascading failures
• Human-agent trust exploitation
• Rogue agents 2

One breakdown of the list matches each risk to a primary defense [1]:

Risk	Primary defense
Goal hijack	Treat retrieved content as untrusted
Identity and privilege abuse	Per-agent identities with short-lived, scoped credentials
Unexpected code execution	Sandboxed execution with deny-by-default egress
Rogue agents	Behavioral monitoring and kill switches

The same source names EchoLeak (CVE-2025-32711, CVSS 9.3) as the defining case for goal hijacking. It was described as the first known zero-click attack on an AI agent, in which one crafted email planted hidden instructions inside a Microsoft 365 environment 1.

A list like this does more than educate. It gives buyers a checklist, and a checklist gives vendors a map of product categories to sell into.

Open source is building, just more quietly

The story that "VC money is racing past open source" is partly true. Open-source maintainers have not ignored agents. A recent roundup of community security tools shows a clear shift toward agent-specific defenses [5]:

• AgentGG is an Apache 2.0-licensed static analysis scanner that uses AI agents to read code, follow imports and walk call graphs, confirming findings before it reports them 5.
• Agent Beacon, from Asymptote Labs, normalizes telemetry from coding agents such as Claude Code, Codex CLI and Cursor across laptops, CI pipelines and cloud runtimes 5.
• CVE Lite CLI, now an OWASP Incubator Project, moves dependency vulnerability scanning into the terminal for JavaScript and TypeScript projects 5.

These tools cover real needs. Agent Beacon addresses the observability gap behind the "rogue agent" and "cascading failure" categories, and supply chain scanning maps directly to ASI04. But they are point tools with volunteer-scale resources. The venture-backed side is building enterprise platforms with sales teams attached.

The read

The interesting tension here is where the money is going within agent security, more than any contest between VC and open source. Funding has piled up around data security and broad AI governance players like Cyera. Meanwhile, MCP, arguably the most direct expression of OWASP's tool-misuse, inter-agent communication and supply chain risks, has drawn a rounding error by comparison 3.

That gap probably won't last. Big acquirers have shown they will write very large checks 3, and seed-stage MCP security firms look like natural acquisition targets once agent deployments mature. Until then, open-source projects and the OWASP framework will likely carry much of the work of defining what "secure agent" actually means. The startups that win may be the ones that turn that community groundwork into products enterprises can buy.