Infisical Raises $40M Series B to Secure AI Agent Access

Between an AI agent's request and a company's API, Infisical places a service that holds the credential and decides whether to attach it. That position gives the San Francisco security company a practical role in enterprise AI adoption: helping an organization delegate work while keeping control of the keys that make the work possible.

Infisical announced a $40M Series B at a $600M valuation on October 27, 2026, led by Elad Gil. Y Combinator, Gradient Ventures, Gallery Ventures, Pace Capital and Dynamic Capital also participated, alongside other investors. The financing supports continued development of its existing security products and a larger investment in Agent Vault, its product for brokering AI agents' access to services.

For an enterprise buyer, the interesting change happens after an agent receives its assignment. A useful agent needs permission to interact with real systems, and someone remains responsible for deciding how far that permission reaches. Infisical is building around that decision, carrying an established secrets-management business into software that increasingly acts on an organization's behalf.

What the Series B finances

Infisical's platform manages secrets, certificates, encryption keys and privileged access. Those are ordinary components of running software, even when the surrounding application is getting an AI makeover. A certificate still needs renewal, an application still needs its configuration, and access to infrastructure still needs an owner who can withdraw it.

The new round expands that existing brief. In the funding announcement, co-founder and CEO Vlad Matsiiako says Infisical will keep investing in secrets management, certificate management and privileged access while substantially increasing its focus on Agent Vault. He also describes plans to hire for more than 100 positions across engineering, sales, marketing, product, design and other functions. Those are expansion plans, rather than a count of completed hires.

There is continuity on the financing side, too. Elad Gil led the $16M Series A announced in June 2025, while Gradient Ventures led the $2.8M Seed announced in July 2023. Returning investors are funding a broader product agenda around the same underlying problem: getting access into software workflows without scattering control along the way.

That continuity matters commercially because a security supplier's next product can enter through an existing relationship. An enterprise already using Infisical to manage application secrets has a concrete starting point for discussing agent access. The discussion still has to reach the people authorizing the deployment and the engineers who will operate it.

How Agent Vault changes credential delivery

Agent Vault is currently labeled as a preview product. Its forward proxy attaches real credentials to outgoing requests, allowing an agent to use an authorized service while keeping the underlying password or API key outside the agent's environment. The architecture moves credential handling into infrastructure that the organization can configure and supervise.

The current documentation describes services, access bundles, sessions and proxies. Services represent the APIs or other systems an agent needs. An access bundle groups those services, a session grants access for a limited time, and the proxy applies the relevant credential when processing a request. Request logs give teams a record to inspect afterward.

This creates an operating question for the buyer: which actions belong inside a particular assignment? A code-review agent and an agent investigating a production incident can require different access. Configurable HTTP methods and paths give administrators a way to narrow permitted calls, while session expiry gives the grant an end. The usefulness of that arrangement comes from the quality of those choices.

Credential isolation also has a physical deployment dimension. Infisical's quickstart recommends running the proxy on a different machine from the agent, while keeping both on the same private network. Co-location can expose the proxy's own sensitive material to agent-side code; distance can add latency to each request. The security boundary has to survive contact with the infrastructure diagram.

The customer relationship behind the agent push

Infisical reports more than 1,300 customers and 300,000 developers across its broader platform. Its company-issued announcement names customers including Airbus, Volkswagen, Hugging Face, OpenRouter, Lucid, First American Financial Corporation, Wise and Clay. These are company-reported platform relationships, rather than disclosed customer counts for Agent Vault.

That distinction helps explain the financing without turning it into a victory lap for a preview product. Infisical has an existing security business through which engineers and enterprises encounter its tools. Agent Vault gives those relationships another subject to discuss as customers evaluate agents, with integration, permissions and deployment design becoming part of the conversation.

The founders have been working on the ergonomics of security since the beginning. Y Combinator identifies Vlad Matsiiako, Tony Dang and Maidul Islam as Infisical's co-founders, with a founding year of 2022. The company's own origin account describes frustration with .env files and security tooling that was too cumbersome to adopt. Agent credential delivery extends that concern into a workflow where the software consuming information can also decide what to do with it.

For a buyer, ease of adoption is therefore part of the control problem. Engineers need an arrangement they can integrate with the agents and services they actually use. Security owners need enough visibility and specificity to authorize that arrangement. Infisical's opportunity sits inside the negotiation between those two groups.

Where enterprise authority meets an API call

Infisical's approach belongs in a broader discussion about how enterprises give machines authority. A secrets store holds sensitive values; a broker controls how those values are applied to requests. Tony Dang's technical account of Infisical's proxy development explains why separating those jobs became important as the company's agent tooling developed.

That separation lets an organization keep using its credential-management practices while changing the last stretch of delivery. It also makes the permitted action worth examining in its own right. An agent can perform an unwanted operation using access it was legitimately granted, so a team evaluating credential brokering still needs to consider what each service permission allows.

Infisical's documentation makes configuration consequential. Requests to an unmatched host may pass without credentials or be refused, depending on the proxy's traffic policy. Client software also needs to route requests through the proxy correctly. These details turn an appealing product promise into an engineering assignment, with explicit decisions about traffic, credentials and the duration of access.

The $40M round gives Infisical resources to pursue that assignment alongside the secrets, certificate and privileged-access products it already sells. As the founders expand the team, their customer conversation can reach from where a secret is stored to the moment an agent tries to use it. Inside that moment, an enterprise's permission decision becomes an actual call to a system somebody else has to keep running.