Hush Security says the AI security problem has shifted from protecting models to governing identities as autonomous agents spread

Hush Security刚刚拿到3000万美元融资，这家公司认为AI安全的核心问题已经变了：以前大家担心的是大模型会不会被攻击，现在最要紧的是管好“AI代理”的身份。啥意思呢？简单说，AI不再只是聊天机器人，而是进化成了能自动执行任务的“数字员工”——比如自己登录系统、调用数据、下单操作。但问题来了，这些AI代理往往用的是启动它的人的权限，就像把公司大门钥匙交给了一个会自己乱跑的机器人。哪怕这个机器人是自家研发的，也可能跑出安全范围，比如之前Hugging Face就发生过AI代理“越狱”的事件。Hush的思路是给每个AI代理一个严格的身份和临时权限，而不是只靠静态密码或API密钥。据预测，到2028年一家大公司可能要管理超过15万个AI代理，现在只有十几个。也就是说，未来你工作中的“同事”可能一半是AI，而如何给它们发“工牌”、监督它们不乱来，会成为每个公司都要面对的新课题。

Less than a year after emerging from stealth to tackle non-human identity security, Israeli cybersecurity startup Hush Security believes the enterprise AI security conversation has fundamentally changed.The company, which earlier this week announced a $30 million Series A round led by returning investors Battery Ventures and YL Ventures with Akamai Technologies joining as a strategic investor, argues that organizations are rapidly moving beyond experimenting with generative AI assistants and into deploying autonomous software agents that require an entirely different security model. While the funding will help expand engineering, U.S. sales and enterprise integrations, Hush is framing the announcement primarily as evidence that identity—not models—is becoming the critical control plane for enterprise AI."The discussion has moved incredibly fast," CEO and co-founder Micha Rave told VentureBeat in a video call interview following the funding news.When Hush launched last year, the company's focus was securing non-human identities—API keys, service accounts, machine credentials and other identities used by software rather than people. Since then, Rave says, customers have increasingly asked a different question: how do they safely allow AI agents to operate inside production systems? This is a pertinent and urgent question ever since Hugging Face revealed in mid-July it was hacked by an autonomous AI agent, later identified as an OpenAI test agent running internally that escaped its secure sandbox, powered in part by an unreleased model. According to Gartner figures cited by the company, the average Fortune 500 organization could be running more than 150,000 AI agents by 2028, compared with fewer than 15 only a year earlier. Hush also points to Omdia research suggesting that 96% of organizations are relying on governance models that were never designed for autonomous AI agents.From machine identities to autonomous softwareThe company's original thesis was that enterprises had accumulated thousands of long-lived machine credentials that were difficult to rotate, audit and secure. Rather than relying on static secrets, Hush developed an identity-based system that brokers short-lived, policy-driven access for machines.Rave says AI agents amplify that same problem."Software now acts autonomously, on its own initiative, inside your most sensitive systems," he said. "AI agents need strict identity, not just API keys."Unlike traditional automation, AI agents frequently act across multiple enterprise systems, invoke external services, make decisions independently and often execute actions using the permissions of the human who launched them. In practice, organizations often grant an agent broad OAuth permissions or administrator credentials simply to enable it to complete tasks.That creates what Hush describes as an identity problem rather than simply an AI problem.During the interview, Rave said virtually every security leader he speaks with faces the same dilemma: either slow AI adoption until appropriate controls exist or allow employees to connect new agents directly into corporate systems despite limited governance."The answer," he said, "is that they let everything in. You cannot stop innovation in the name of security."Identity becomes the control pointRather than treating AI agents as another application requiring credentials, Hush is extending its existing non-human identity platform into what it calls an "Identity Gateway" for AI agents.The platform sits between agents and enterprise resources, allowing organizations to discover agents, assign each one its own identity, associate it with a responsible human owner, broker task-specific permissions at runtime and maintain centralized audit logs.Instead of allowing an agent to inherit all of a user's privileges indefinitely, Hush attempts to enforce what it calls "least agency"—granting only the permissions necessary for the specific task being executed.The company s