From open-source key vault to AI Agent security platform, Infisical raises $40 million

Beating AI News Flash: Infisical has completed a $40 million Series B funding round, reaching a valuation of $600 million. The YC-incubated company started with open-source secrets management, helping enterprises safeguard sensitive information such as API keys and database passwords while controlling access permissions. It currently has over 1,300 enterprise customers and 300,000 developer users, including Airbus, Volkswagen, Hugging Face, and OpenRouter.

As AI Agents like Claude Code and Codex begin operating GitHub, databases, and cloud services, secrets security has become a new problem. Agents frequently need to read external web pages, documents, and code, and once induced by hidden malicious instructions within them, they may leak the keys they hold.

In April this year, Infisical open-sourced Agent Vault, which gives Agents only fake keys. When accessing external services, requests first pass through an HTTPS proxy, which injects the real key before sending. This way, even if an Agent is tricked into handing over the key it holds, the real password cannot be directly leaked. In July, the company launched a commercial version of Agent Proxy, integrated with its existing enterprise secrets management system.

Today, the related features have been integrated into the commercial Agent Vault. Enterprises can authorize Agents on a per-task basis, set expiration times, revoke permissions at any time, and log access behavior. For example, a code review Agent only gets the necessary access permissions for GitHub and Slack, which are revoked once the task is complete.

Companies such as Anthropic and Vercel have also adopted similar credential proxy technology. Infisical has built it into independent security infrastructure that can be shared across different Agents such as Claude Code, Codex, and OpenClaw.