RunSybil

RunSybil is an AI-native offensive security company that automates penetration testing to identify and exploit vulnerabilities in real-time. The company was founded in 2023 by CEO Ari Herbert-Voss, who was the first security researcher at OpenAI and a core research contributor to GPT-3 and Codex, and CTO Vlad Ionescu, the former Head of Offensive Security Red Teaming at Meta. Their shared expertise in machine learning, offensive security, and red teaming from prominent tech and security firms like Mandiant and NCC Group underpins the company's core mission to automate hacker intuition.

The firm's flagship product is an AI agent named Sybil, which performs continuous, autonomous penetration testing on live applications and infrastructure. Unlike traditional security tools that rely on static source code analysis, Sybil interacts with systems through their external interfaces to discover, exploit, and document real security vulnerabilities without human intervention. This black-box testing approach allows the AI to reason like an attacker, chaining together minor weaknesses to find significant security gaps, such as cross-tenant data access and privilege escalation, that are often missed by legacy scanners and point-in-time human-led penetration tests. The platform aims to provide security feedback on every pull request, reducing the false positive rate and eliminating the need for expensive and infrequent bug bounty programs.

RunSybil operates on a subscription-based business model, targeting a diverse client base that includes startups like Cursor, Notion, and Turbopuffer, as well as undisclosed large financial institutions and Fortune 500 companies. In March 2026, the company announced it had raised $40 million in a funding round led by Khosla Ventures, with participation from S32, Anthropic's Anthology Fund, Menlo Ventures, and prominent angel investors, to accelerate its research, development, and go-to-market operations.

Keywords: offensive security, autonomous penetration testing, AI cybersecurity, active defense, vulnerability validation, AI agent, continuous attack surface monitoring, black-box testing, security automation, red teaming, exploit generation, application security, infrastructure security, AI-native security, hacker intuition, vulnerability discovery, exploitability validation, adversarial reasoning, security feedback, security posture management