Onyx, Groundcover and Spur Raised $413M in One Day to Supervise AI Agents
Three rounds closed in a single session, all funding the same problem from different angles. Onyx Security raised a $113 million Series B led by Bessemer for a platform that lets enterprises deploy AI agents securely, taking total funding to $153 million. Groundcover raised a $100 million Series C led by One Peak for observability software capable of monitoring AI agents, bringing its total to $160 million. Spur Intelligence raised $200 million led by Insight Partners for technology that distinguishes human from bot traffic to identify fake users and threats.
That is $413 million committed in twenty-four hours to watching, permissioning, and attributing machine actors. Two adjacent rounds funded agents themselves: Encore AI took $30 million for voice agents trained on customer interactions, and Freehand raised a $75 million Series B for supply chain agents aimed at large enterprises. The supervision layer raised more than five times what the agent builders did.
Three control planes, not one product category
The rounds map cleanly onto three distinct problems that security teams are currently solving with spreadsheets and hope.
The first is identity and authorization. An agent acting on behalf of a user needs credentials, and the credential it needs is almost always broader than the task requires because scoping it correctly is harder than granting it fully. Onyx sits here, and this is the layer where the existing identity and privileged access vendors will fight hardest, because an agent is recognizably a machine identity and machine identity is an established category.
The second is runtime behavior. An agent that has been granted correct permissions can still take a sequence of individually authorized actions that adds up to something nobody sanctioned, and it can do so at a speed no human review process catches. Observability tooling that traces agent action chains and flags anomalous sequences is the detection answer, and Groundcover’s positioning treats it as an extension of application performance monitoring rather than as a security product.
The third is attribution at the edge. Once a meaningful share of inbound traffic is agents acting for legitimate users, the binary bot-versus-human decision that fraud and abuse systems were built around stops working. Spur’s problem is separating the agent you authorized from the agent attacking you, which is the same signal problem web application firewalls face and a harder version of it.
The cost signal is the tell
OpenAI’s open-source agent harness, which now powers Codex and ChatGPT Work, is being optimized to cut runaway token usage. The company that builds the agents is instrumenting them to contain their own consumption, which is the most honest available statement about what unsupervised agent loops do in production.
The same day, OpenAI released an early version of its Codex Security CLI for scanning repositories, verifying fixes, and adding security checks to CI/CD pipelines. That closes the loop in the other direction: agents writing code, and tooling to check what the agents wrote before it merges.
Enterprises evaluating this category should note that none of the three control planes is complete on its own, and that a security programme which permissions agents without observing them, or observes them without attributing inbound agent traffic, has covered one third of the surface. The funding pattern suggests investors have already worked that out.