MindFort is building autonomous AI agents that continuously pentest live web applications and networks, validate exploitable findings, and ship patches as pull requests. The product is aimed at engineering and security teams who can no longer rely on quarterly human pentests or noisy scanners to keep pace with AI-accelerated development. Teams point MindFort at an app, and thousands of agents run in parallel to chain vulnerabilities into working proofs of exploit, with runs triggered on a schedule, continuously, or as part of CI/CD on every push.
This launch coincides with a $3M seed round and the company's debut out of Y Combinator's X25 batch , alongside a new feature called Hill Climb that lets agents consolidate memories across runs so they get more efficient at finding bugs over time. There is also an API for plugging the agents into adjacent workflows like triaging inbound bug reports, validating findings from other tools, and running targeted security reviews. The company says it is already in production with startups and public companies.
The team has direct background in this space. Co-founder Brandon Veiseh previously worked at ProjectDiscovery, where he led development of the Nuclei cloud platform, and at NetSPI, one of the largest penetration testing firms, building generative AI tooling for human testers. Co-founder Akul Gupta comes from the research side, with a CS masters from UIUC and prior work co-authoring papers on LLM-driven cybersecurity attacks and red teaming at OpenAI and Anthropic.
Comments (9)
Sign in to join the discussion.
P
Priya VasudevanApr 29, 2026
Cool agents, but who owns the pager when the autonomous patch breaks prod at 2am? Asking for every SRE I've ever known.
T
Tomasz K.Apr 29, 2026
The thumbnail crop on this tweet is brutal, you cut off half the headline. Spend ten more minutes in Figma next time, the product deserves it.
M
Maya OkonkwoApr 29, 2026
Genuinely curious about the API surface here. Can I scope an agent to a single repo, and what happens when it hits rate limits mid-exploit chain?
K
Kenji AramakiApr 29, 2026
Been tracking this space for a while and the validation step is where everyone trips. If their agents actually weed out false positives, every AppSec team will quietly forward this internally.
L
Laila MansourApr 29, 2026
Was already telling my LPs about MindFort last quarter. The CI/CD-native angle is the wedge, bug bounty platforms are about to feel very 2018.
J
Janne PulkkinenApr 29, 2026
Autonomous patching in production is a beautiful demo and a terrifying changelog. The market for this shrinks the second one agent yeets a bad fix into a Fortune 500 monolith.
V
Vikram S.Apr 29, 2026
We prototyped something adjacent on an internal security team in 2019 and the hard part was never finding bugs, it was getting devs to merge the PRs. Curious how MindFort handles the human-in-the-loop bit.
R
Rohan BhattApr 29, 2026
If they're staffing up I have an offensive security engineer in Lisbon who eats CI pipelines for breakfast. DMs open.
S
Saoirse DrennanApr 29, 2026
The launch tweet is sitting at a weird like-to-reply ratio, lots of lurkers and not much debate. Either the pitch is airtight or security folks are too paranoid to engage publicly.
Work With Us
Book an intro call to explore our suite of services. We might have a waitlist.
MindFort AI × YC
Autonomous Security Agents
@mindfort
Autonomous Security Agents
Tags
TLVC Rating
Community Rating
No ratings yet
to rate this launch.
MindFort is building autonomous AI agents that continuously pentest live web applications and networks, validate exploitable findings, and ship patches as pull requests. The product is aimed at engineering and security teams who can no longer rely on quarterly human pentests or noisy scanners to keep pace with AI-accelerated development. Teams point MindFort at an app, and thousands of agents run in parallel to chain vulnerabilities into working proofs of exploit, with runs triggered on a schedule, continuously, or as part of CI/CD on every push. This launch coincides with a $3M seed round and the company's debut out of Y Combinator's X25 batch , alongside a new feature called Hill Climb that lets agents consolidate memories across runs so they get more efficient at finding bugs over time. There is also an API for plugging the agents into adjacent workflows like triaging inbound bug reports, validating findings from other tools, and running targeted security reviews. The company says it is already in production with startups and public companies. The team has direct background in this space. Co-founder Brandon Veiseh previously worked at ProjectDiscovery, where he led development of the Nuclei cloud platform, and at NetSPI, one of the largest penetration testing firms, building generative AI tooling for human testers. Co-founder Akul Gupta comes from the research side, with a CS masters from UIUC and prior work co-authoring papers on LLM-driven cybersecurity attacks and red teaming at OpenAI and Anthropic.
Comments (9)
Cool agents, but who owns the pager when the autonomous patch breaks prod at 2am? Asking for every SRE I've ever known.
The thumbnail crop on this tweet is brutal, you cut off half the headline. Spend ten more minutes in Figma next time, the product deserves it.
Genuinely curious about the API surface here. Can I scope an agent to a single repo, and what happens when it hits rate limits mid-exploit chain?
Been tracking this space for a while and the validation step is where everyone trips. If their agents actually weed out false positives, every AppSec team will quietly forward this internally.
Was already telling my LPs about MindFort last quarter. The CI/CD-native angle is the wedge, bug bounty platforms are about to feel very 2018.
Autonomous patching in production is a beautiful demo and a terrifying changelog. The market for this shrinks the second one agent yeets a bad fix into a Fortune 500 monolith.
We prototyped something adjacent on an internal security team in 2019 and the hard part was never finding bugs, it was getting devs to merge the PRs. Curious how MindFort handles the human-in-the-loop bit.
If they're staffing up I have an offensive security engineer in Lisbon who eats CI pipelines for breakfast. DMs open.
The launch tweet is sitting at a weird like-to-reply ratio, lots of lurkers and not much debate. Either the pitch is airtight or security folks are too paranoid to engage publicly.