Bay emerges with $50M to check every AI agent action before it runs

Bay argues that first-generation AI security tools mostly filter prompts and responses, which misses where the damage happens: a harmless-looking prompt can still end with an agent deleting a production database[2]. The founders hit that problem themselves when one of their coding agents, using legitimate permissions, tried to expose a cloud environment to the internet to finish a test[1].

When an agent proposes an action, the AI tool running it passes the request to a local binary called Bay Enforcer through a native hook. The check runs on the machine with the whole session as context and returns a verdict in milliseconds, sometimes as a prompt for the user to approve the step[2]. Anything judged too risky never runs.

Policies come from a system called Lighthouse, which drafts one per team from the last 30 days of agent activity so security staff do not have to write rules for every new tool. Teams can replay a policy against the previous month to see what it would have stopped, and Bay says false positives run under 1%[2].

Bay names Micron, Peloton, ClickUp and Wix among dozens of enterprise customers, and says Fortune 100 companies on the platform tripled their use of autonomous agents in just under 30 days[1][2]. Micron started as a customer before its venture arm invested[2].

"Bay was built to be the one platform that secures every way the enterprise uses AI, so security becomes the reason AI ships faster, not the reason it stalls," co-founder and CEO Yuval Zacharia said[1].

Zacharia founded the company with CPO Aner Morag and VP of R&D Boris Danilovich, who previously led a department of 90 engineers at CrowdStrike[1]. The money will expand product and engineering in Tel Aviv and sales, marketing and customer teams in the US and Europe[2].

As coding agents and assistants gain real permissions on laptops and cloud accounts, the risk moves from what a model says to what it does. Bay is betting that a per-action checkpoint, close to the endpoint and learned from each team's own behaviour, is the control layer enterprises will need before they let agents run unattended.