Pluto Security gets $42M to give firms real-time AI visibility

Pluto came out of stealth with $42 million in total funding. That includes an $8.5 million seed round led by TLV Partners, with the founders of cybersecurity company Armis also investing, and a $34 million Series A led by Jump Capital. Skinos, the venture firm of Check Point co-founder Shlomo Kramer, joined the Series A along with Ansa Capital and angel investors.

The company started selling in April and says it has already passed $2 million in annual recurring revenue, the yearly value of its subscriptions. Reports differ on its size: one put it at more than 30 enterprise customers and 40 staff, while the company’s own announcement claimed more than 40 customers and over 50 employees in the US and Israel. Named customers include Sixt, Oscar Health, AlphaSense and Workato.

Bahat founded Pluto with Tal Ofer Regev, a former head of research and development at Palo Alto Networks, and Gil Maman, who spent years in technical roles in Israeli military intelligence. Bahat previously held senior security roles at Microsoft.

Pluto’s software tracks the AI tools employees use and everything those tools depend on: skills, extensions, MCP servers (connectors that let AI tools reach other apps and data) and the apps and agents people build with them. It flags risky components, spots dangerous agent behavior and enforces company rules without blocking people from using AI.

To do that, it plugs into existing endpoint security and device management systems, or installs its own sensors on laptops. It collects prompts, commands, running programs, permissions and a user’s past activity, then uses small AI models on the device to judge what an agent is trying to do.

The standout feature is that Pluto can step in while an agent is working. If an agent tries to grab more permissions than its user meant to give it, Pluto can stop the action or add instructions to the session telling the agent to ask for confirmation first. Bahat describes the shift as a move from watching user behavior to watching agent behavior.

About 60% of the risks Pluto finds across its customers are in tools vibe-coded by non-developers, meaning apps built by describing them to an AI rather than writing code. Finance departments are the biggest source, followed by marketing and then legal. Developers come fourth.

One example: at a Fortune 500 company, Pluto says it found a vibe-coded app that someone in finance had made to track customers and churn. Anyone on the internet could reach it. Bahat also says every trial deployment the company ran turned up something malicious, from bad extensions to skills, and some had live attacks under way during the test.

Pluto’s research team showed what this looks like in practice in late October. It found 31 malicious repositories across seven accounts on Hugging Face, the popular site for sharing AI models. They posed as small Qwen2 test models and targeted GPU servers running self-hosted inference tools.

The trick abused a Hugging Face option called trust_remote_code, which lets a model ship its own Python code. If a user turns it on, that code runs as soon as the model loads. In this case it quietly installed a cryptocurrency miner disguised as a system process, and some versions opened a backdoor giving the attacker direct access.

Hugging Face and China’s ModelScope removed the first wave after Pluto reported it, but a second wave of 19 repositories appeared within days. The top model’s downloads climbed from 7,354 at the time of the report to 28,412 by October 28, while standard malware scans marked it clean. Pluto says downloads aren’t the same as confirmed infections, and it estimates the operator’s wallet collected roughly $5,000 in cryptocurrency. Anyone who loaded these models with that setting on should treat the machine as compromised and change any passwords or keys it could reach.

For employees, expect more oversight of the AI tools you install and the apps you build. Security teams are moving from banning tools outright to watching what they do and stepping in when an agent goes too far.

A few habits help now. Only install AI add-ons and connectors your company has approved. Don’t put customer data into an app you built yourself unless IT has checked it. And never switch on settings that let downloaded models run their own code unless you trust the source.

Pluto also runs Plutonium, a free site launched in April where anyone can check the risks of public AI skills, connectors and add-ons. The company says it will spend the new money on its product, its security research and growth in the US.