Mindgard Secures $30M to Fortify AI Security After Uncovering Critical Vulnerabilities

Mindgard, the AI security startup out of Lancaster University, just closed a $30 million Series A — and the receipt that got them there is the kind that makes a CISO's phone ring at 2am: a zero-day in Cursor's AI-powered editor that lets an attacker run arbitrary code, no phishing link or malware drop required. The team disclosed it responsibly. The funding is the easy part of the story.

The round was led by Album VC, with Karma Ventures joining and .406 Ventures, Atlantic Bridge, IQ Capital, and Lakestar coming back. Total funding now sits near $42M, up from roughly $11.9M raised across a 2023 seed round and a December 2024 tranche. James Brear, who previously ran Swimlane, Veriflow, and Procera, took the CEO seat in October 2025 as the company shifted from research to enterprise sales. Dr. Peter Garraghan, the Lancaster professor behind more than a decade of AI security research, is chief science officer.

What they found, and what it means

Over the past year, Mindgard researchers disclosed more than 150 vulnerabilities across AI products. Three landed hardest:

• A zero-day in Cursor — the AI-powered editor — that let an attacker run arbitrary code on a developer's machine, no phishing link or malware drop required.
• A bypass of ChatGPT's image-generation guardrails, the kind of finding that turns a moderated product into a policy-violation machine.
• A data-leakage flaw in Google Antigravity that crossed trust boundaries, meaning one tenant's data could leak to another.

All three were disclosed responsibly. That's the part of the disclosure cycle that doesn't make headlines but absolutely should. The point of red-teaming is not to publish; the point is to make the patched version the version the world runs.

The new attack surface is real

[[CHART: AI security market on a steep upward curve toward 2033]]

"AI is creating an entirely new attack surface, and organisations need a fundamentally different approach to securing it," said Brear. Two major AI security competitors were acquired in the past year. The market is projected to hit $56.5 billion by 2033.

Three shifts happened at once. AI moved from demos to production — models, agents, and LLM-backed features are shipping in customer-facing products, not just internal tools. The threat model changed: static checklists ("is the input sanitized?") miss prompt injection, model exfiltration, agent hijacking, and tool-use abuse. Those attacks don't look like SQL injection; they look like a user typing a sentence. And the talent pool got serious. Mindgard itself grew out of more than a decade of academic work at Lancaster, the kind of offensive security muscle that takes years to build, finally showing up as commercial product.

Why "operationalize expertise" beats "automate attacks"

The line in Brear's statement that matters most is the one most people will skip past: "We don't just automate attacks. We operationalize expertise, turning the knowledge of leading AI security researchers and offensive security practitioners into the capabilities every enterprise needs."

A pure-play attack-automation platform is easy to build and easy to defeat — defenders patch the surface, scanners update their signatures, the loop continues. Mindgard's bet is that AI vulnerabilities change too fast for signature-matching. The platform does three concrete things, every day, against running systems:

1. Discovery   — find "shadow AI" usage inside the org
2. Testing     — red-team deployed models, agents, and apps
3. Monitoring  — watch AI applications in production for drift

That last piece — monitoring — is where most security vendors fall down. They test at deployment and call it done. Mindgard treats the AI application as a living target, which it is, because model behavior shifts with every fine-tune, every prompt-template change, every new tool the agent gets handed. A prompt template that was safe in staging can be unsafe in production the moment a tool is added to the agent's reach, and a scanner that ran clean last week won't notice.

The platform simulates real attacker behavior rather than relying on static checklists. That's the operationalizing-expertise piece: not "run this prompt and check the output" but "act like a person who has spent a decade finding ways around AI guardrails." That expertise is what the $30M is buying scale for — more researchers, more continuous coverage, more models under test.

How to use this today

If you're shipping AI features — agents, copilots, image generation, code editors, retrieval pipelines — the practical question is what you do on Monday.

1. Audit your shadow AI. Most companies don't have a complete inventory of which employees and teams are calling which models on which projects. Mindgard's discovery layer is built for this; you can also start with a manual pass through your expense reports, your gateway logs, your browser extensions, and your IDE plugin inventory.
2. Red-team your deployed AI now. Don't wait for a bug bounty submission from someone less friendly than Mindgard. The Cursor zero-day, the ChatGPT bypass, the Antigravity leak — all three were disclosed responsibly, but the next ones might not be.
3. Treat AI as a living attack surface. A model that was safe in staging can be unsafe in production the moment a tool is added to the agent's reach. Continuous monitoring — not point-in-time testing — is the only answer that scales.
4. Budget for it. The market is on its way to $56.5B by 2033 for a reason. The line item is moving from "R&D curiosity" to "required spend" inside most enterprise security budgets, and the companies that don't line-item it will be the ones explaining a breach next quarter.

For teams already shipping with Cursor, the disclosure window is the moment to patch your build environments, segment your agent's permissions, and assume any code the editor proposes is untrusted input until you've reviewed it. The same rule applies to any agent that can write files or call tools — treat the output as if it came from an untrusted stranger on the internet, because architecturally it did.

The durable layer underneath the model churn

Here's the part that doesn't change when the model does: the application around the model. The AI gets cheaper, faster, and more capable every quarter. The threat surface shifts with it — a new tool the agent gets handed is a new way out of the sandbox. But the cross-platform runtime — the component layer, the auth boundary, the data pipeline the agent can reach — is the part that has to hold up across every model swap, every fine-tune, every new tool the agent gets.

That's the layer worth investing in once. Build the same component on web, iOS, and Android against one API, so a security fix in one place lands in all three. Wire the agent's tool permissions into a single source of truth so you can revoke a capability everywhere at once. Treat the data boundary the agent can cross as an architectural decision, not a per-model policy you rewrite every release. When the next Cursor zero-day drops, or the next ChatGPT bypass lands, the part of your stack that's already durable doesn't need to be redone — it just needs to be re-tested.

Mindgard does the red-teaming. The application around the model is what you build. Both have to be done, and the team that does both well is the team that ships AI features that survive contact with the real world.