Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-29 · high
Cyera bought Oasis for $1B, Act Security exited stealth with $60M, and Hush Security raised $30M, all betting agents need revocable, scoped access.
Why now: All three deals surfaced in the July 28 funding roundup behind this July 29 recap, the same day MCP shipped a permissions-focused protocol overhaul of its own.
Cyera agreed to buy Oasis Security for $1 billion on July 28, one of three security deals worth $1.09 billion that day, per SecurityWeek, PR Newswire, Axios Pro and Calcalist.
Gartner expects the average Fortune 500 company to run more than 150,000 AI agents by 2028, up from fewer than 15 in 2025. Only 13% of organizations say they can govern that. Every one of those agents needs credentials, and most hold standing access nobody checks or revokes.
All three deals sell versions of the same fix. Stop handing agents permanent credentials, scope access to the task in front of them, and keep one registry that can kill any agent's access the moment something looks wrong.
Act Security left stealth the same day with $60 million: a $20 million seed from Team8 and Bessemer, plus a $40 million Series A from Notable Capital. Hush Security closed its own $30 million Series A, with Akamai joining as a strategic investor.
Cyera didn't build this in house. It bought Oasis instead, the clearest signal in the batch: nobody in this category thinks there's time left to build agent-identity infrastructure from scratch before the agent count explodes past what any team can track by hand.
In a related release the same day, MCP shipped its largest protocol revision yet, adding OAuth 2.1 and a stateless core, a separate push to formalize how agents authenticate at the protocol level. Between the funding and the protocol work, knowing who an agent is and what it may touch is becoming a purchased dependency, the way SSO did a decade ago.
Each link below shares sources, entities, or timing with this story.
Adyen already ships an abstraction layer that talks to three rival protocols, a sign no single spec is expected to win.
A researcher found hidden Unicode markers in Claude Code's system prompts flagging traffic from DeepSeek, Zhipu, Baidu, and Alibaba, and Anthropic removed the code without saying so in the changelog.
Oasis raised a $120 million round just four months before this sale, which ranks as 2026's second-largest cybersecurity deal behind Accenture's Dragos stake.
Boundary-Bench ran 12 agent harnesses through real firewall and filesystem locks, and costs climbed as much as 167 percent as those restrictions tightened.
All three built their new agents on NVIDIA's Agent Toolkit, so the fight is now about autonomy depth, not whose model is smartest.
A new analysis of AP2 v0.2 found eight high-severity gaps where signed payment mandates don't cover the steps that set up the transaction.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.