Infisical's $40M Round Says AI Agents Shouldn't Hold Your Keys
Infisical raised a $40M Series B at a $600M valuation for a product that lets AI agents work without holding credentials. The lesson for a small team is blunt: keep keys out of agent context and issue scoped, revocable access instead.
Key takeaways
- Infisical raised $40M at a $600M valuation, led by Elad Gil with Gradient and Y Combinator.
- Agent Vault gives AI agents access without handing over the underlying credentials.
- The company reports more than 1,300 customers, 300,000 developers and more than 30,000 GitHub stars.
- Open source is doing the distribution work, and the buyer worry is new.
- Keep keys out of agent context and issue scoped, revocable credentials instead.
Infisical raised a $40M Series B at a $600M valuation on 27 October 2026, and the product at the centre of the round is a vault for AI agents (PR Newswire). The number worth copying is not the valuation. It is the rule underneath the product: an agent should not hold your keys. It should ask a broker for scoped, revocable access, and the broker should keep a record. If you are wiring an agent into a real system this week, that rule matters more than the funding headline.
TL;DR
- Infisical raised $40M at a $600M valuation, led by Elad Gil with Gradient and Y Combinator.
- Agent Vault gives AI agents access without handing over the underlying credentials.
- The company reports more than 1,300 customers, 300,000 developers and more than 30,000 GitHub stars.
- Open source is doing the distribution work, and the buyer worry is genuinely new.
- Keep keys out of agent context and issue scoped, revocable credentials instead.
Disclosure: ZeroRaised publishes this analysis and is a launch site for bootstrapped products. Facts come from the linked sources as checked on 28 Oct 2026; ZeroRaised has no commercial relationship with the companies named.
Agent credential brokering is the practice of keeping secrets out of an agent's context and issuing short-lived, narrowly scoped credentials for each action the agent is allowed to take. Agent Vault is Infisical's product for that job: a company defines what each agent may reach, and the agent gets access without receiving the underlying credential (PR Newswire).
What did Infisical actually raise?#
The round is a $40M Series B at a $600M valuation, led by Elad Gil, who also invested in the company's Series A, with Gradient and Y Combinator participating (PR Newswire). A returning lead is a useful signal: someone with better information than you kept buying.
The disclosed numbers describe a product already in use. Infisical reports more than 1,300 customers and 300,000 developers, and says it secures 10 billion secrets each day (PR Newswire). That is not a pre-revenue security bet. It is a company selling into an existing habit and adding a new use case on top.
Why do AI agents need access without credentials?#
The CEO's framing is the whole sales pitch in one line. "You wouldn't give an employee unrestricted access to every system in your company, and AI agents shouldn't be any different," Vlad Matsiiako said (PR Newswire).
That analogy works because every security buyer already has a process for onboarding a person: identity, role, approval, review and offboarding. An agent with a long-lived API key in an environment variable has none of that. It has a secret that can end up in a prompt, a trace, a log file or a support ticket, with no clean way to revoke it for one workflow without breaking the rest.
Elad Gil's quote makes the category case explicit. "AI agents are becoming a new class of users inside every enterprise, and securing their access will be one of the biggest cybersecurity challenges of the next decade," he said (PR Newswire).
You do not need the decade claim to see the problem: a new class of users means identities, scopes, expiry, audit and revocation. Many teams building agents have built the fun part and skipped that list.
Why do 30,000 GitHub stars matter more than the round?#
Infisical's open-source project has more than 30,000 GitHub stars (PR Newswire). Stars are a weak metric, but a decent proxy for a specific motion: a developer tries the tool, runs it locally, and becomes the person who recommends it when a security review appears.
That is the bottom-up sequence many open-source infrastructure companies have used. The free tool spreads through engineers, the paid product solves the problems that appear at company scale, and the buyer arrives later with a budget. A bootstrapped founder cannot copy the $600M valuation, but the sequence is available to almost anyone: ship something a developer can install in an afternoon, make it useful before payment, and let the paid tier solve the problem the free tier creates.
The trap is assuming open source is distribution by itself. A repository with no clear use case is a support burden, not a funnel. Infisical's numbers come from a working tool, not a licence choice.
What is the product lesson for agent builders?#
Agent Vault lets companies give AI agents access without handing over credentials, and lets them define the access each agent needs (PR Newswire). Read that as three features sold as one: a policy layer, an issuance layer and an audit layer.
The unit of sale is a boundary, not storage. A customer buys a smaller blast radius, a record of what the agent did and a way to switch it off. That answers a question a demo cannot: what happens when the agent is wrong or compromised.
If you build an agent product, copy the design principle rather than the pricing. The agent never sees the secret. Your tool layer holds the credential, checks the request against a narrow policy, performs the action and writes a log entry. That is more work than pasting a key into a prompt, and it is the difference between a product a reviewer approves and one that dies in procurement.
What should you do this week?#
- Remove keys from agent context. Check system prompts, tool schemas, memory, logs, traces, screenshots and support tickets. If a key can appear in a trace, assume it is already in one.
- Give each agent its own identity. Separate tokens per agent, per workflow and per environment so that revoking one does not take down the rest.
- Scope and expire. Grant the least privilege the task needs, set short lifetimes and keep a one-click revoke path. Our guide to rotating API keys covers the operational side.
- Put a broker between the agent and the secret. The tool call should reach your service, and your service should inject the credential. The model should never receive it.
- Sandbox and log. Deny egress by default, log every tool call and alert on unusual destinations. The agent sandboxing guide has the setup.
- Test the blast radius. Ask what a compromised agent could reach in one hour, then read the vibe-coded app security checklist against that answer.
Where ZeroRaised fits#
If you build agent tooling rather than the vault, the buyers are the same people: small teams that need to ship without a security department. ZeroRaised is a launch and discovery site for products built without institutional venture capital or accelerator equity, and you can submit your product to get a launch page with the facts a buyer needs.
We make no promise of traffic or sales. A launch page puts your claims, pricing and security posture in one place a reviewer can read. For the next analysis like this, join the ZeroRaised newsletter, and for the broader question, read how to build a defensible AI product.
Sources#
Frequently asked questions
What is Agent Vault?
Agent Vault is Infisical's product for giving AI agents access to systems without handing over credentials. A company defines the access each agent needs, and the agent works through that boundary rather than holding a key it could leak, log or reuse somewhere else.
Why is agent credential management a funded category?
Because, as investor Elad Gil puts it, agents are becoming a new class of users inside companies. They need identities, permissions, audit trails and a way to revoke access, and many current setups give them a long-lived API key in an environment variable instead. Infisical's $40M round is a bet that buyers will pay to close that gap.
Should a bootstrapped founder buy a vault or build one?
Start by removing credentials from agent context, which costs nothing. If you need per-agent identity, short expiry, policy checks and an audit log, compare the cost of building and maintaining that against a vendor. A small team should usually buy the undifferentiated part and spend its own time on the product.
Does open source guarantee security adoption?
No. Open source makes a tool easy to try and easy for a developer to champion internally, which is why it can act as distribution. It does not guarantee that a security team will approve it, that the project is well maintained or that a paid conversion follows.
What is the minimum safe pattern for agent credentials?
The agent never sees the secret. Your service holds the credential, checks the request against a narrow policy, performs the action and writes a log entry. The credential should be scoped to one job, expire quickly and be revocable without breaking every other agent you run.