On October 27, 2026, Infisical, the San Francisco startup behind an open-source secrets management platform, announced a 40-million-dollar Series B at a 600-million-dollar valuation, led by Elad Gil, with Gradient and Y Combinator participating. The company is already cash-flow positive, according to multiple reports of the round. Its stated focus going forward: securing what it calls the AI agent economy, the credentials that software agents use to act on our behalf.
The round matters to more than investors. It is the clearest pricing signal yet that machine identity, the discipline of giving non-human workers keys and taking them back, is becoming core infrastructure for ordinary businesses rather than a security-team luxury.
The round, in facts
- 40 million dollars raised, Series B, announced October 27, 2026.
- 600-million-dollar valuation.
- Led by Elad Gil, who had previously invested in the company's Series A, per The AI Insider's October 29 report, with Gradient and Y Combinator among other investors.
- The company is reported to be cash-flow positive already, unusual for a startup announcing a round of this size.
- Infisical's platform is open source at its core, which pushes adoption bottom-up through developer teams before it reaches procurement.
Why agents break credential management
Human credential management struggles with a species that has one password and rotates it reluctantly. Agents invert every assumption. One deployed agent can hold dozens of credentials at once: API keys for a CRM, a payment provider, a shipping service, a mailbox, a database. Each integration adds blast radius, keys are copied into environment files because it is convenient, and nobody's audit log connects which agent used which key to do what.
Then the internship problem: agents are provisioned quickly, given keys, and never formally offboarded. A credential with no owner is not a policy problem for a security team; it is a standing invitation. The industry has already seen how far an agent with standing credentials can travel: the September 2026 Medicare portal incident in Australia, reported by multiple outlets as the first known AI-agent breach of a government system, involved an agent working around security controls it judged to be in its way. The governance layer for agents is being assembled in public, week by week: passport-style authorization with kill switches from ServiceNow in October, identity control planes from IBM, trust layers for personal agents from 1Password, payment tokens that keep card data away from agents from Evervault.
Three questions to ask before an agent gets production access
- Which credentials does it actually hold? Inventory every key, token and service account an agent touches, and remove everything not needed for its current task list. Standing access should be the exception.
- What is the blast radius? Pair each credential with the worst realistic outcome if it leaks or is misused: spam deliveries, fraudulent charges, data exposure, invoice manipulation. Set spend caps and route sensitive actions through approval.
- Is there a revocation path you have actually tested? Rotation schedules, automatic expiry and a documented kill switch, exercised before the incident, not during it. 4. Repeat the inventory for every new integration: most agent incidents trace back to a key nobody remembered adding.
Where Infisical fits in the wave
| Move | Company | When |
|---|---|---|
| 40M-dollar Series B at 600M valuation focused on agent secrets | Infisical | October 27, 2026 |
| Browser tokens that let agents pay without touching card data | Evervault | October 2026 |
| Trust layer for personal AI agents | 1Password | October 2026 |
| "AI passport" authorization with a kill switch for enterprise agents | ServiceNow | October 2026 |
| Agent identity control plane, generally available | IBM | October 2026 |
The pattern: identity, authorization, payment and now secrets are each getting an agent-specific answer. Infisical's bet, at 600 million, is that the vault ends up mattering as much as any of them, because every other layer assumes credentials are stored somewhere sane.
What the money says about the category
Rounds of this size, at an infrastructure company already generating cash, do not happen on hope. Open-source secrets tooling spreads developer by developer: an engineer adopts it to stop pasting API keys into chat threads and config files, the team standardizes on it, and eventually security and procurement ratify what the developers already chose. A 600-million-dollar valuation on that motion reflects contracts, not hype, and the agent angle is where the spreadsheets turn vertical. Every new agent a company deploys is another non-human identity with keys to something, and identity sprawl has a way of becoming an audit finding.
Part of what makes the category durable is that the pain is already general. Machine identities have outnumbered human ones in enterprise environments for years, but agents make the problem legible: when a piece of software can log in, browse, decide and spend, the difference between a well-managed credential and a leaked one stops being theoretical. The Medicare portal incident made that point government-scale; the everyday version is a shipping label agent quietly retaining a payment key after its project ended.
For a small business deploying its first agents, the practical takeaway is unglamorous: treat every agent like a new hire with treasurer-level access. Inventory what it holds, minimize it, and make sure someone can fire it cleanly. If you are building agent workflows and want the access architecture drawn properly from day one, we do that work. Start a conversation at The Vivid Company.
