Finance is the biggest source of security risks Pluto finds in AI tools created by non-developers. These “vibe-coded” tools account for about 60% of the risks the company detects across its customer base. Marketing and legal teams follow finance, while developers rank fourth.
Shahar Bahat, Pluto’s CEO and co-founder, told TechCrunch that a newly announced AI tool can enter a company’s environment just two hours after its release. Pluto’s tools apparently uncovered one app built by a finance employee at a Fortune 500 company to handle customer information and churn. The vibe-coded app was accessible over the internet.
Now out of stealth with $42 million in funding, Pluto is betting that companies need security tools that follow not only the AI products employees use, but also the tools they create and the actions AI agents take. Pluto started selling in April and has exceeded $2 million in annual recurring revenue. It has more than 30 enterprise customers, including Oscar Health, Workato, Sixt, and AlphaSense.
The company’s funding comprises an $8.5 million seed round led by TLV Partners, with backing from the founders of cybersecurity firm Armis. Pluto also recently secured a $34 million Series A led by Jump Capital. Other participants included Skinos, the venture firm of Check Point co-founder Shlomo Kramer, Ansa Capital, and angel investors.
AI security risks aren’t confined to large technology companies that top AI adoption charts, a trend reflected in Pluto’s traction. Bahat said the risks differ based on a CISO’s outlook and an organization’s willingness to adopt AI, but they can arise in either case.
“In general, I’ll say there was not one POC in which we entered and didn’t find malicious stuff,” she said. “Whether those are extension packages or skills – some of them had active live attacks while we did the POC. Which again, for me, product-wise is amazing. For the companies, it’s not very good.”
According to Bahat, security teams must watch what agents do in real time, while also keeping track of what employees build and deploy and how they do so. “We’re moving from user behavior to agent behavior,” she said.
Pluto’s software keeps tabs on employees’ AI tools and the skills, extensions, MCP servers, and other components they depend on. It also monitors the apps and agents employees create. The company says the software can flag risky components and potentially dangerous agent activity, then apply security policies without preventing employees from using or building AI tools.
Pluto links with endpoint security and device management systems, using them to install its own sensors or placing the sensors directly on devices. There, it collects prompts, commands, running processes, permissions, and users’ past activity. Pluto also runs its own “lightweight” models on endpoints to help determine what an agent is attempting to do.
Bahat said the system can step in as an agent works. For instance, if an agent seeks permissions beyond what the user intended, Pluto can block the action or add instructions to the session asking the agent to get confirmation. “We can inject context back to the session, and this way I can change how the agent is working,” Bahat said.
Pluto is using a free product to connect with security teams. Released in April, Plutonium allows anyone to check publicly available AI skills, connectors, and add-ons for risks. It also has an MCP scanner and a catalog of verified components. Bahat claims thousands of security professionals use Plutonium, and says its community provides feedback and potential customers.
Bahat said inbound interest now accounts for 70% of Pluto’s sales pipeline, though she didn’t specify how much comes directly from Plutonium. Pluto plans to put the new funding toward product development, broader security research, and expansion in the U.S. The company has 40 employees in the U.S. and Israel.
