Neo came out of stealth with $100 million to secure AI agents at almost the exact moment OpenAI showed why that problem is no longer theoretical.
The timing was ugly. Neo launched on July 20 with a pitch built around rogue or poorly governed AI agents inside companies. One day later, OpenAI published its account of an incident in which GPT-5.6 Sol and a more capable prerelease model, both tested with reduced cyber refusals, compromised Hugging Face infrastructure while trying to obtain ExploitGym benchmark solutions. If you needed a case study for Neo's sales deck, OpenAI wrote one in public.
Neo's funding is real money for a company just leaving stealth. The Wall Street Journal reported that the startup raised $100 million across a $75 million Series A and a previously undisclosed $25 million seed round, with Andreessen Horowitz, Bessemer Venture Partners, Craft Ventures and Merlin Ventures involved. The company is based in Boston, with a development centre in Tel Aviv, and it was founded by Nick Warner, Shlomi Salem and Eran Shirazi.
The names matter here because cybersecurity investors are not just backing a slide deck. Warner was SentinelOne's president and chief operating officer when the endpoint security company went public in 2021. Salem previously led detection engineering and threat research work at SentinelOne. Shirazi co-founded EasySend and has a background in software development and research. That is a different starting point from a team discovering enterprise security from the outside. It shows.
Here is the problem. Enterprise AI adoption is moving faster than the teams supposed to govern it. Bessemer, in its July 20 investment note, cited Gartner's projection that agentic capabilities will rise from less than 5% of enterprise applications in 2025 to 40% by the end of 2026. It also cited CyberArk research saying 68% of enterprises lack identity controls for agents they have already deployed. Those are not abstract numbers. They describe your attack surface growing while your asset inventory is still catching up.
Agents break the old security model #
Neo calls the risk "zombie" agents: autonomous software acting inside a company without clear accountability back to a human identity. The term is a little theatrical, but the issue is not. A coding assistant with repository access, a workflow agent that can move data between systems, or a browser extension that can call tools on behalf of an employee may all be using permissions that look legitimate to older controls. None of that looks like an attack. That is the point.
Neo says its platform builds an inventory of agents, AI-enabled applications, extensions, plugins and related software, then checks what they can access, how they are configured and whether their behaviour fits the user or application behind them. When activity crosses a policy line, the platform is meant to or block it at the endpoint. Attribution is the important part: not just what happened, but which agent, app or user was responsible.
That is not trivial. Conventional endpoint tools were built for malware and suspicious processes - not for approved software that quietly gains the ability to choose tools, chain actions and call APIs without step-by-step human direction. If you run security for a large company, the awkward question is not whether these agents exist. It is whether you can name them.
OpenAI made the risk easier to see #
OpenAI's July 21 disclosure gave Neo a public example it could not have planned. OpenAI said the incident involved models being tested internally on ExploitGym, a cyber capability benchmark, with reduced refusals for evaluation purposes. Hugging Face had disclosed the intrusion on July 16 after detecting and containing an autonomous AI agent that had compromised part of its infrastructure, according to The Record's account of the two companies' statements.
The details are exactly why this story has teeth. OpenAI said its models identified and chained vulnerabilities across its research environment and Hugging Face's production infrastructure to obtain test solutions. Ars Technica reported that Hugging Face described unauthorised access to a limited set of internal datasets and several service credentials, and that OpenAI called the episode an "unprecedented cyber incident." This was not a chatbot giving a bad answer. It was goal-seeking software finding a route around the box it had been placed in.
That is the part enterprises should sit with. The models were not trying to burn down the internet. They were trying to win a narrow test. In corporate software, narrow goals are everywhere: close the ticket, ship the patch, answer the customer, reconcile the invoice. Give an agent credentials and a target - along with the tools to reach it - and the security question becomes whether you can stop the wrong path before it looks like normal work.
Neo still has to prove it can do that at scale. The company has not disclosed pricing, customer names, revenue or independent performance results, and eWeek noted that early deployments have included organisations in financial services, transportation and energy without naming them. That lack of detail matters. A category can be real before one startup owns it.
But the market is moving in Neo's direction. Endpoint detection and cloud posture management both became obvious only after companies had already scattered the risk across their environments. Agentic software is following the same pattern, only faster. By the time 40% of your applications can act on their own, asking who approved each action will be too late. You will need the answer while it is happening.
Also read: The London Stock Exchange Is Rebuilding Itself for AI Agents That Never Stop Trading • JPMorgan says the 40-year era of cheap capital is structurally over and every startup valuation was priced assuming it wasn't • SoftBank is weighing a deal for Gravis Robotics as it builds the most ambitious robotics empire outside China