Act Security walked out of stealth on July 28 with $60 million and a claim that cuts against a decade of security spending: the problem isn't unpatched holes, it's standing access. A $20M seed led by Team8 and Bessemer plus a $40M Series A led by Notable Capital, from the team that built Medigate — the medical-device security company Claroty bought for $400M. Their pitch is that patching and posture management are losing, because cloud environments have piled up too much access and AI now walks those paths faster than any human can close them.

You are a team of one and you are not buying this. Read it anyway, because the signal is aimed at you.

The signal: two $60M rounds, two weeks, one breach path#

Two weeks ago, Oak raised $60M to give AI agents real, verifiable identities. This week, Act raised $60M to control what those identities are allowed to touch. That's not two companies — it's two ends of one problem, funded to the same number inside a fortnight. We wrote up the Oak round as a signal, not a sales pitch; Act is the second data point that turns a signal into a pattern.

The pattern: the over-permissioned agent is the attack surface of 2026. It fits the bet the July funding wave made — control the agents, or own a regulated vertical — squarely on the control side. When the smart money points twice at the same weakness in two weeks, the weakness is real, and if you've wired an agent into your infrastructure, it's yours.

The weakness, concretely#

Here's how it happens to a solo builder, no negligence required. You give an agent an API key to ship a feature. The key is broad because scoping it precisely was fiddly and you were shipping. The task ends; the key doesn't. Six months later you have a handful of long-lived credentials, each able to touch far more than its job needs, sitting in env files and CI logs and one agent's memory. That's access sprawl, and for agents it's worse than for people: an agent acts continuously, can be steered by a prompt injection buried in a web page it reads, and multiplies faster than you audit. One leaked or hijacked key is standing access to everything it can reach, until you happen to notice.

That is exactly the condition Act sells enterprises a platform to shrink. You can shrink it yourself for free.

An agent should never hold a standing, broad, long-lived credential. It should get a short-lived, scoped, revocable one — minted per task, gone in minutes, logged on every use.

The one-person version of the fix — three moves#

1. Kill the static key. Mint short-lived scoped tokens. Your cloud already does this — STS on AWS, OIDC workload identity on GCP/Azure. The agent asks for a token scoped to one resource that expires in minutes, does the task, and the credential is gone before it can leak into a log that matters. Here's the 10-minute version of exactly this move.

2. Give each agent its own identity. If every agent runs as you, a single compromise is a compromise of everything, and you can't revoke one without locking yourself out. A distinct service account per agent means one bad actor gets cut off alone. This is the whole point of the non-human identity playbook: agents are workloads, not extensions of you.

3. Log every privileged action with the agent id attached. "The API was called" tells you nothing when the caller might be a hijacked loop. "Agent invoice-bot, task pay-vendor-4821, at 14:02" tells you which agent, doing what, so a hijack leaves a trail you can actually follow — and stop.

What it means: none of this needs a vendor. It's your cloud's existing primitives, a secrets manager, and a weekend. Do the three moves and you've bought yourself most of what a $60M category is selling — a smaller blast radius when, not if, one agent goes wrong. The funded platforms exist because doing this at a thousand-agent enterprise is genuinely hard. At your scale, it's just discipline you can adopt before the round's ink is dry.

The founder's move for Monday: open the one agent you've given the broadest access, and ask what it could touch if a web page it reads tomorrow tells it to. If the honest answer is "most things," you already know your first task — and it's cheaper than the seed round that just validated it.