Infisical secures $40 million in funding, expanding from open-source secret vaults to AI Agent security platforms.

Beating AI Express: Infisical closes a $40 million Series B funding round, valuing the company at $600 million. The Y Combinator-backed firm started as an open-source key management provider, helping enterprises secure sensitive information like API keys and database passwords while controlling access permissions. It now has over 1,300 enterprise clients and 300,000 developer users, including Airbus, Volkswagen, Hugging Face, and OpenRouter. As AI agents such as Claude Code and Codex begin operating GitHub, databases, and cloud services, key security has emerged as a new challenge. Agents often need to access external web pages, documents, and code; if tricked by hidden malicious instructions in these resources, they may leak the keys they hold. In April this year, Infisical open-sourced Agent Vault, which grants agents only fake keys. When accessing external services, requests first go through an HTTPS proxy that injects the real key before transmission. This way, even if an agent is tricked into handing over its held keys, it cannot directly leak the actual credentials. In July, the company launched the commercial version of Agent Proxy, integrated with its existing enterprise key management system. The relevant features have now been consolidated into the commercial Agent Vault. Enterprises can authorize agents on a per-task basis, set expiration dates for permissions, revoke access at any time, and log access activities. For example, a code review agent only gets necessary access to GitHub and Slack, with permissions revoked once the task is complete. Companies like Anthropic and Vercel also use similar credential proxy technologies. Infisical has built this into an independent security infrastructure that can be shared by different agents including Claude Code, Codex, and OpenClaw.