Pluto Security Exits Stealth With $42M to Watch What AI Agents Do

Pluto Security has raised $42 million and emerged from stealth to sell enterprises visibility and control over the AI tools their employees already use — and the AI agents those employees are building without permission.

The company started selling only in April. It has already crossed $2 million in annual recurring revenue and signed more than 30 enterprise customers, including Oscar Health, Workato, Sixt and AlphaSense, CEO and co-founder Shahar Bahat told TechCrunch.

The funding splits into an $8.5 million seed round led by TLV Partners — with the founders of cybersecurity firm Armis also investing — and a $34 million Series A led by Jump Capital, with participation from Skinos, the venture firm of Check Point co-founder Shlomo Kramer, plus Ansa Capital and other angels.

Why are investors betting $42 million on this?

Pluto is the latest entrant in a fast-forming category of security startups built on one conviction: repurposing existing security software to monitor AI tools, connectors and usage is a square-peg-round-hole approach. Investors are backing that thesis with large checks.

The stakes are concrete. Bahat says a newly announced AI tool can show up inside a company's environment within two hours of its release. Once there, employees use it in unexpected ways, and security teams often cannot see what is happening.

The risk is not confined to technology companies that lead AI adoption charts. Bahat said the issues she sees are differentiated by the mindset of the chief information security officer and how willing the organization is to adopt AI — but every organization carries risk.

"In general, I'll say there was not one POC in which we entered and didn't find malicious stuff," Bahat said. "Whether those are extension packages or skills — some of them had active live attacks while we did the POC. Which again, for me, product-wise is amazing. For the companies, it's not very good."

Who is actually creating the risk?

Not developers, according to Pluto's data. About 60% of the risks Pluto detects across its customer base sit in tools vibe-coded by non-developers.

Bahat ranked the sources:

• Finance departments generate the biggest share of risk.
• Marketing teams rank second.
• Legal teams rank third.
• Developers rank fourth.

Pluto's tools found one vibe-coded application built by a finance employee at a Fortune 500 company to manage customer information and churn. The application was left exposed to the internet.

That case illustrates the scale of the problem: a single employee with an AI coding tool can put customer data on the public internet without any developer, security review or procurement process in the loop.

What does Pluto's product actually do?

Pluto's entire bet is that securing these environments requires security tools to watch what AI agents do in real time, in addition to tracking what employees build and deploy.

"We're moving from user behavior to agent behavior," Bahat said.

In line with that vision, Pluto's software monitors:

• The AI tools employees use.
• The skills, extensions, MCP servers and other components those tools rely on.
• The apps and agents employees create.

The company says it can identify risky components, spot potentially dangerous agent activity, and enforce security policies — without blocking employees from using or building AI tools.

To collect the data, Pluto connects to endpoint security and device management systems, and can deploy its own sensors through them or directly onto devices. It gathers prompts, commands, running processes, permissions and users' previous activity. Lightweight models run on the endpoints themselves to help assess what an agent is trying to do.

Can it stop an agent mid-task?

Yes, and that capability is the differentiator. Pluto's system can intervene while an agent is working, Bahat said.

If an agent attempts to gain permissions beyond what the user intended, the system can stop the action outright — or take a subtler path. It can insert additional instructions into the session that push the agent to ask the user for confirmation before proceeding.

"We can inject context back to the session, and this way I can change how the agent is working," Bahat explained.

That in-session intervention model goes beyond logging and alerting. It treats the agent's prompt context as a control surface, which legacy endpoint and access-management tools were never designed to touch.

How does a months-old startup land 30 enterprise customers?

Pluto takes an unusual route to market. In April, alongside its commercial launch, it released Plutonium, a free platform that lets anyone check risks associated with publicly available AI skills, connectors and add-ons. Plutonium also includes an MCP scanner and a catalog of verified components.

Bahat claims thousands of security professionals use Plutonium and that the community around it has become an important source of feedback and of prospective customers.

The inbound channel now dominates. Bahat said 70% of Pluto's sales pipeline comes from inbound interest, though she did not break down how much of that arrives directly through Plutonium.

What comes next?

Pluto plans to invest the new capital in three areas: developing the product, expanding its security research efforts, and growing its U.S. presence. The company currently employs 40 people across the U.S. and Israel.

The traction is real but not unique in this market — a crop of security startups has sprung up quickly around AI-era fears, and most are raising big money. What separates the winners will be whether agent-behavior monitoring becomes a budget line at every enterprise that has allowed AI tools past its firewall. Given that Pluto found malicious components in every proof of concept it ran, the demand side of that question appears already answered.