Infisical Raises $40M at $600M Valuation [2026]

Infisical, the San Francisco startup behind a popular open-source secrets manager, announced on Tuesday, October 27, 2026 that it raised $40 million in Series B funding at a $600 million valuation. Elad Gil led the round. The pitch is simple to state and hard to execute: AI agents need access to source code, databases and cloud infrastructure, so Infisical wants to give them that access without ever letting them hold the passwords.

Forbes Middle East carried the story under a headline about keeping company secrets safe from AI agents, and the Forbes report describes the core trick plainly. Infisical hands an agent a fake API key, and the real credential is attached somewhere the agent cannot see. That detail matters because it changes what an attacker gets if an agent is tricked, and it explains why investors are paying attention. Our look at the identity providers built for AI agents covers who an agent is. Infisical’s round is about what that agent is allowed to carry once it gets inside.

This analysis walks through the numbers, the product, the timeline that led to the raise, where the deal sits among other 2026 security rounds, and what developers can do right now. Every figure below comes from Infisical’s own announcement, the PR Newswire release, SecurityWeek, or Forbes. Where a number is the company’s claim and nobody has checked it independently, we say so.

Infisical Raises $40M: The Round at a Glance

Infisical said the Series B values the company at $600 million. Elad Gil, who also invested in the Series A, led the round. Gradient and Y Combinator took part, and CEO Vlad Matsiiako’s blog post adds Gallery Ventures, Pace Capital and Dynamic Capital to the list. SecurityWeek put the company’s total funding at nearly $60 million after this round, which implies roughly $20 million raised before it. That last figure is our arithmetic, not a reported number.

The company said it will spend the money on faster product development, more engineering and go-to-market hires, and deeper AI agent security work. Matsiiako wrote that Infisical is hiring for more than 100 positions across engineering, sales, marketing, product and design. For a company of this size, that is a large hiring plan relative to the cash raised, and it signals how much the founders expect the agent market to grow.

Item	Detail	Source
Announcement date	October 27, 2026	PR Newswire release
Round	$40 million Series B	Company announcement
Valuation	$600 million	Company announcement
Lead investor	Elad Gil (also in the Series A)	PR Newswire, SecurityWeek
Other investors	Gradient, Y Combinator, Gallery Ventures, Pace Capital, Dynamic Capital	PR Newswire, CEO blog
Total funding after round	Nearly $60 million	SecurityWeek
Headquarters	San Francisco	PR Newswire
Open roles	100+	CEO blog post

Why Investors Are Betting on AI Agent Security

Gil’s stated thesis is that AI agents are becoming a new class of user inside every enterprise, and that securing their access will rank among the biggest cybersecurity challenges of the next decade. He also said he believes Infisical can become essential infrastructure for the AI era, and he credited Matsiiako and co-founders Maidul and Tony with spotting early that agents would create a new set of security problems. Those are his words in the press release, and they are the clearest statement of why the check was written.

A returning lead investor carries extra weight. Gil backed the company at Series A, so he has seen its operating numbers and customer growth up close. Matsiiako’s post says Gil is doubling down since the Series A, while Y Combinator and Gradient Ventures are tripling down. When existing backers lead and follow on in a priced round, it usually means they liked what the data showed. Outside investors reading the same announcement get a cheaper, if imperfect, signal.

The valuation math is worth a look. A $40 million raise at $600 million equals about one-fifteenth of the stated valuation. Neither the release nor SecurityWeek says whether the $600 million figure is pre-money or post-money, so we cannot say precisely how much of the company the new investors bought. The valuation also sits at roughly ten times the nearly $60 million Infisical has raised in total. For a security vendor that says it is already cash-flow positive, that is a premium for category position, not for rescue financing.

How the Fake API Key Trick Works

The Forbes report summarizes Infisical’s fix as trickery: the agent receives a fake API key, which is the password applications use to talk to each other. SecurityWeek fills in the mechanics. The agent works with placeholders, the real secrets get injected at a proxy and never reach the agent, and every agent request passes through Infisical and gets logged.

Infisical’s product FAQ explains the plumbing. The agent’s HTTP clients point at a forward proxy through the standard HTTPS_PROXY environment variable. On the way out, the proxy applies the real credential to any request headed for a configured service. Depending on setup, it attaches the authorization header, replaces the header the agent sent, or swaps a placeholder for the real value. The credential stays in Infisical and never lands in the agent’s environment, filesystem or context window.

What a prompt injection can and cannot reach

Prompt injection is the attack the design targets. An attacker plants instructions in text an agent reads, and the agent follows them. If the agent holds a live API key, a successful injection can send that key anywhere. Infisical says a hijacked agent in its setup has no credential to leak, and that the damage stays inside the services listed in that session’s access bundle. The proxy denies and logs anything outside the bundle, according to the company. That is a vendor claim about its own product, and independent testing has not been published in the sources we reviewed.

The press release names a second leak path that gets less attention. Even with no attacker involved, many organizations do not want agents sending credentials to model providers or other tools. A brokered setup keeps the real value out of the prompt, so it cannot end up in a provider’s logs.

Agent Vault Features: Access Bundles, Sessions and Audit Logs

The commercial Agent Vault page lists five building blocks. The company labels the product as currently in preview and warns that features and pricing may change, which is a useful caveat for anyone planning a purchase.

• Proxies. A transparent man-in-the-middle proxy attaches credentials to outbound requests. It intercepts traffic whether the agent uses MCP, a command-line tool, an SDK or raw API calls. It can run on its own host or beside a single machine.
• Access bundles. Reusable lists of the APIs and services an agent may reach during a session. Admins can narrow any service to specific HTTP methods or paths.
• Time-bound sessions. Every session expires on a schedule the admin sets, and running agents lose access within 60 seconds of the session ending.
• Audit logging. Logs show every agent request, whether it succeeded, and who created the session it ran in.
• Deployment choice. Customers can self-host or use Infisical Cloud in US and EU regions.

The company says no code changes are needed for any agent that honors HTTPS_PROXY. Its FAQ names Claude Code, Codex, OpenClaw and Hermes as examples, along with custom harnesses. Each agent can also get its own machine identity in Infisical, so grants and log entries belong to that agent and not to whichever engineer launched it. That detail answers a question auditors ask early: who actually did this?

Credential control is one layer. Permission control is another, and the two fail differently. Our report on Claude Code v2.1.311 letting agents run rm without asking shows what happens when the permission layer loosens. A broker limits which services an agent can call. It does not decide whether the agent should delete a directory on the machine it runs on.

From Open-Source Agent Vault to a Commercial Product: The 2026 Timeline

The funding round did not come out of nowhere. Infisical spent 2026 building and renaming its agent-security line, and the sequence explains how the product now on offer differs from the open-source project that developers first saw.

Date	Event	What changed
April 2026	Open-source Agent Vault launches	MIT-licensed HTTP credential proxy and vault for AI agents, shipped as a single binary with its own store
July 29, 2026	Agent Proxy announced	Commercial successor that fetches secrets from Infisical instead of storing them, with 30+ service presets
Later in 2026	Agent Vault returns as a commercial preview	Adds access bundles, time-bound sessions and session logs on top of credential brokering
October 27, 2026	Series B and a blog post on keeping .env files from agents	$40M at $600M, with a stated plan to increase focus on Agent Vault

The company said the open-source Agent Vault crossed 2,000 GitHub stars in a few months, with tens of thousands of installations, millions of agent runs and dozens of agents in use, including Claude Code and OpenClaw. Those are the company’s usage claims. It then concluded that it had bundled two ideas together, the secrets store and the secrets broker, and that the broker works better when it pulls from a mature store.

Agent Proxy was the answer. It stores nothing, retrieves secrets from Infisical on demand, and ships inside the Infisical CLI or as a Docker container. According to the July post, it is available on any plan and comes with presets for more than 30 services, including model providers such as Anthropic and OpenAI, plus GitHub, Slack and Datadog. The original repository stays online, but the company’s FAQ says it is not actively maintained and was never built for a team. Anyone who adopted the April version should read that sentence twice.

Infisical by the Numbers: 1,300 Customers and 10 Billion Secrets a Day

The press release says Infisical serves more than 1,300 customers and 300,000 developers, secures 10 billion secrets every day, and has earned more than 30,000 GitHub stars for its open-source project. It lists Airbus, Volkswagen, Hugging Face, OpenRouter, Lucid, First American Financial Corporation, Wise and Clay as customers. The CEO’s blog post names LG and the US Government in its own list, so the two customer lists do not match exactly.

One number deserves a flag. The July Agent Proxy post said Infisical processes billions of secrets per month. The October press release says 10 billion secrets every day. The two may measure different things, such as stored secrets versus retrieval requests, and the company does not explain the gap. Treat the daily figure as a company-reported scale indicator, not an audited metric.

The customer names still tell a story. Hugging Face and OpenRouter sit close to the model ecosystem, where agents call many third-party APIs. Wise and First American Financial are regulated finance names, where audit trails carry real weight. A vendor that spans both groups has a credible claim to the agent-security market, even if the agent-specific revenue is small today. Infisical did not disclose revenue, and we will not guess at it.

Why Raise $40M When You Are Cash-Flow Positive?

Matsiiako’s post makes an unusual claim for a venture-backed startup. He wrote that Infisical did not have to raise this round, has been cash-flow positive for a long time, and holds more money in the bank than it has ever raised. Nobody outside the company has audited those statements, and the financials are not public.

Taken at face value, the claim reframes the deal. This is growth capital, not survival capital. The stated reason to raise now is speed. The CEO argues that the industry is changing faster than ever, and that Infisical can play a much bigger role in securing the next generation of software infrastructure. Money buys engineers faster than organic revenue does, and the plan to fill 100-plus roles shows where it is going.

There is a second reading, and it is more cynical. A profitable company that raises at $600 million also gets a war chest for acquisitions, a stronger recruiting pitch, and a public valuation marker that large customers see when they run vendor-risk reviews. Security buyers like to know a vendor will exist in five years. A fresh round answers that question without a single sales call.

The Three Shifts Behind the Pitch

Matsiiako’s announcement argues that AI models and the agents they power changed software over the past year in three ways. First, far more software is being written. He claims coding agents have increased code output by more than 10x and that a lot of it is low quality. He gives no source for the 10x figure, so read it as the founder’s estimate. More code means more infrastructure, machine identities, credentials and certificates to protect.

Second, attackers have more openings. More deployed software widens the attack surface, and once an attacker is inside, credentials such as API keys, passwords and private keys are what let them move deeper. Third, agents are gaining access to sensitive systems and taking actions that used to need human approval, often without proper oversight. He put it with a colorful phrase about headless chickens, which is not how security vendors usually talk.

The tooling layer is a live target, too. Our report on the tampered Claude Code extension that reached 5,000 Cursor users shows how a trusted agent integration can turn hostile. If a compromised extension runs with the developer’s environment variables, any key sitting in that environment is gone. A broker does not stop the compromise, but it shrinks what the attacker can take.

Credential Brokering vs Older Patterns

Infisical argues that credential brokering has become common across serious agent deployments. Its July post points to the architecture described in Anthropic’s Managed Agents blog, Vercel’s credential brokering, Cloudflare’s outbound workers and the architecture behind Claude Tag. That is Infisical’s characterization of those designs, and we have not verified each one. The shared principle it describes is that the agent never sees real credential values, and may hold a fake one that a broker swaps at the edge.

The table below is our framing of the main choices a team faces. It compares patterns, not vendors, and it does not rank specific products.

Pattern	Where the real secret lives	What a hijacked agent can reach	Main trade-off
Secrets in a .env file or the agent’s environment	On the agent’s machine and in its context	Every credential in the file	Simple to set up, easy to leak
Agent fetches secrets at runtime from a manager	In the manager, then in the agent’s memory	Whatever the agent fetched, for as long as it holds it	Better rotation and audit, but the agent still handles the value
Brokered through a forward proxy	In the manager and the proxy only	Only the services in the session’s access bundle, and only through the proxy	Adds a proxy to run, trust and monitor

Teams that cannot adopt a proxy this quarter can still cut exposure. Our walkthrough of guarding secrets in Cursor and VS Code covers ignore files and auto-approve settings that keep sensitive files out of an agent’s reach. Those steps work at the editor level. Brokering works at the network level, and the two stack well.

Market Impact: Where $600M Sits in a Busy Security Funding Year

SecurityWeek covered a run of security rounds around the same time. Cyera raised $600 million at a $12 billion valuation in June 2026, according to SecurityWeek, and we tracked reports of it seeking nearly double that in our piece on Cyera eyeing a $20 billion valuation. Upwind raised $400 million at a $3.8 billion valuation, which we covered in Upwind’s Series C. Infisical’s $40 million at $600 million is a far smaller deal than either, but it targets a narrower and newer problem.

The agent-specific end of the market is also getting money at smaller sizes. SecurityWeek reported that former Unit 8200 officers raised $34 million for Mave, an agentic security-operations startup, and that Asymptote Labs landed a $5.5 million seed for AI agent runtime security. The pattern is clear. Investors are funding agent security at every stage, from seed to growth, and they are funding it as its own category.

For incumbents, the risk is that secrets management gets redefined. Infisical itself describes the shift as moving organizations away from legacy tooling. If agents become the main consumers of credentials, then a secrets product built around human engineers and static workloads has to add brokering, short-lived sessions and agent identities, or lose ground. We expect that pressure to show up in feature roadmaps before it shows up in revenue.

What Developers Should Do This Week

You do not need Infisical to act on the lesson. Five steps cut risk this week, and none of them needs a new budget line.

• List every credential an agent can read today, including .env files, shell history, config directories and CI variables.
• Remove long-lived production keys from developer machines where agents run. Replace them with scoped, short-lived tokens wherever the service supports it.
• Decide which services each agent actually needs, and narrow access by HTTP method and path if your tooling allows it.
• Route agent traffic through a proxy that attaches credentials at the network boundary, and keep that proxy on a separate host from the agent.
• Turn on request logging, and review the log for calls to hosts you do not recognize.

Because the broker pattern relies on the standard proxy variables, the agent-side change is small. The snippet below shows the idea with a placeholder host. It is a generic illustration and not Infisical’s documented setup, so follow the vendor’s guide for real deployments.

# Point the agent's HTTP clients at a credential-brokering proxy export HTTPS_PROXY="http://broker.internal.example:8080" export HTTP_PROXY="$HTTPS_PROXY"  # The agent now sends a placeholder credential. # The proxy swaps in the real one before the request leaves your network.

A proxy that intercepts encrypted traffic usually needs the agent’s environment to trust its certificate, so plan for that during testing. Run the first trial against a low-risk service, such as a read-only API, and confirm the log shows both allowed and denied calls before you widen the scope.

Risks and Open Questions

The announcement leaves several things unproven. Agent Vault is in preview, and the company says features and pricing may change. Nothing in the coverage we reviewed shows how many customers run it in production or what it adds to revenue. The usage numbers for the open-source version are the company’s own.

The design also moves risk instead of erasing it. A proxy that holds or fetches every credential an agent might need becomes a high-value target. If an attacker takes over the proxy host, the protection collapses. Infisical recommends running the proxy on a separate host from the agent for exactly this reason, and that advice deserves to be followed literally. This is our analysis of the architecture, not a reported vulnerability.

Finally, brokering addresses credential theft, not bad decisions. An agent allowed to call a payments API can still make a harmful call through the proxy. Access bundles, method and path limits, and session expiry narrow that risk, but they do not remove it. Teams still need review steps for actions that move money, delete data or change production systems.

Predictions: 5 Calls for the Next 12 Months

These are our editorial forecasts, not reported facts. We have no inside information from Infisical or its investors.

1. Credential brokering becomes a checkbox item. Enterprise security questionnaires will start asking whether agents can read production credentials, and vendors without an answer will lose deals.
2. Larger platforms ship native brokers. Cloud providers, identity vendors and agent platforms will add their own versions, which squeezes standalone products unless they keep a lead on audit and policy.
3. Agent identities get their own governance. Machine identities per agent, with owners and expiry dates, will move from best practice to audit requirement at regulated firms.
4. More agent-security rounds follow. The mix of seed, Series B and late-stage deals in 2026 points to continued funding, and at least one more round in this niche should clear $100 million.
5. The first public brokered-agent incident lands. Someone will find a way around a proxy or a badly scoped bundle, and the write-up will shape the next round of product design.

Readers tracking the wider category can find more in our AI and machine learning coverage, where we follow agent tooling, model releases and the security questions that come with them.

Frequently Asked Questions

How much did Infisical raise, and at what valuation?
Infisical raised $40 million in a Series B round at a $600 million valuation, announced on October 27, 2026. SecurityWeek put its total funding at nearly $60 million after the round.

Who led the Infisical Series B?
Elad Gil led the round. He also invested in the Series A. Gradient and Y Combinator took part, and the CEO’s post adds Gallery Ventures, Pace Capital and Dynamic Capital.

What is Infisical Agent Vault?
It is a product that lets AI agents reach services such as APIs and HTTP tools without reading the underlying credentials. A proxy attaches the real secret to outbound requests, while the agent works with a placeholder. The commercial version is in preview and adds access bundles, time-bound sessions and audit logs.

Is the open-source Agent Vault still maintained?
Infisical’s FAQ says the open-source repository stays online but is not actively maintained and was never built for a team. The company points teams to the commercial product instead.

Does a credential proxy make AI agents safe?
No. It reduces credential theft and limits what a hijacked agent can call, but it does not stop an agent from making a harmful call to a service it is allowed to use. Teams still need scoped access, session limits and review steps for risky actions.

Which customers does Infisical name?
The press release lists Airbus, Volkswagen, Hugging Face, OpenRouter, Lucid, First American Financial Corporation, Wise and Clay. The CEO’s blog post also names LG and the US Government. The company reports more than 1,300 customers and 300,000 developers.

Does Infisical disclose revenue?
No revenue figure appeared in the announcement, the press release or the coverage we reviewed. The CEO says the company has been cash-flow positive for a long time, but that statement is unaudited.