Bay raises $50M to check AI agent actions before they run

The next AI security budget line is a gate between "the agent decided" and "the agent did." On November 10, Tel Aviv startup Bay came out of stealth with $50 million to check every AI agent action before it runs. The founding story is the pitch: one founder's own coding agent tried to expose a cloud environment to the internet to finish a test, with permissions it legitimately held. Nothing was hacked. The agent was just doing its job.

What actually happened

Per SiliconANGLE, The Next Web and Globes:

• Funding. A $37 million Series A led by Battery Ventures, plus a $13 million seed co-led by YL Ventures and Striker Venture Partners that was not announced before. Micron's venture arm and Wiz CEO Assaf Rappaport also invested.
• Company. About nine months old, about 35 people, mostly in Israel. The founders come from Unit 8200, Hunters, Noname Security and CrowdStrike.
• How it works. The tool running the agent hands each proposed action to a local Bay binary through a native hook. Bay checks it against policy with the whole session as context and returns a verdict. Bay's site lists four: allow, ask, steer or deny. "Steer" tells the agent how to finish the job inside the rules. Bay's FAQ names Claude Code and Cursor.
• Policy. A system called Lighthouse drafts per-team rules from 30 days of agent history. You can test the rules against past activity before you turn them on.
• Customers. Micron, Wix, ClickUp and Peloton are named. Micron is also an investor.

Some numbers are Bay's own and not checked by anyone else: false positives under 1%, setup in under five minutes, and Fortune 100 customers who "tripled" agent use in about 30 days. TNW notes that last claim names no companies and gives no method. No pricing is public. Bay sells to enterprises through demos.

Why it matters for your business

You probably won't buy Bay. A 10-person shop is not its customer. But the pattern is the right one, and you can run a cheap version of it this week.

The risk is not a hacker. It is an agent with real credentials doing something reasonable-looking: terraform apply on the wrong workspace, git push --force, a curl to a database URL it found in .env. Approving every action by hand doesn't scale, and auto-approving everything is how the cloud gets exposed.

What we set up for clients running Claude Code:

1. Deny rules in settings.json. Block reads of .env and secrets folders, and block rm -rf, force pushes and production deploy commands outright.
2. A PreToolUse hook. A short script that sees every shell command before it runs. It can block it or send it to a person, and it logs everything.
3. Short-lived, scoped credentials. The agent's cloud role can't open a security group, so a bad decision fails closed.
4. Read the log weekly. Thirty days of history is how Bay writes policy. It works for you too.

Sources: SiliconANGLE, The Next Web, Globes, Bay.