In April 2026, an autonomous AI agent from a then-stealth startup found a set of hardcoded credentials in a public JavaScript file. Within 18 minutes, it had breached a major consulting firm’s internal AI platform, accessing nearly 10,000 private client conversations [New Claw Times, April 2026]. The agent was not a malicious hacker, but a product from CodeWall, a new London-based company that believes the best way to defend an enterprise is to attack it, continuously.
CodeWall emerged in October 2026 with a $4 million pre-seed round led by Osney Capital, with participation from InReach Ventures and Antler [GlobeNewswire, October 2026]. Its core product is an autonomous AI agent that approaches corporate systems from the outside, mimicking an external threat actor to identify and chain exploitable attack paths. The company’s early wedge is a shift in methodology: from periodic, human-led penetration tests to a persistent, automated offensive capability.
The Attack Agent as a Product
The technical premise is straightforward. CodeWall’s agents operate without requiring credentials, source code, or internal network access, scanning an organization’s public-facing assets as any attacker would [Unite.AI, October 2026]. The goal is to map the attack surface and demonstrate real exploit chains, delivering verified proof-of-concept vulnerabilities. This is not a vulnerability scanner that merely lists CVEs; it’s an agent designed to perform the reconnaissance, exploitation, and lateral movement steps of a real breach, but under controlled conditions for the defender.
Founder and CEO Paul Price, formerly Global Head of Distribution at Morgan Stanley Investment Management, is targeting banks and other financial institutions first, a sector with both high security budgets and catastrophic breach costs [Bloomberg, retrieved 2026] [cfotech.co.uk, October 2026]. The initial traction is provocative: the company reports its agents identified vulnerabilities across platforms at McKinsey & Company, Boston Consulting Group, and Bain & Company earlier in 2026 [cfotech.co.uk, October 2026]. While these are demonstrations, not necessarily paying customers, they serve as powerful validation of the agent’s capability against complex, high-value targets.
The Funding and the Roadmap
The $4 million pre-seed is earmarked for expanding the product’s coverage of enterprise environments and building out workflows for sustained testing, verification, and remediation [GlobeNewswire, October 2026]. The round’s investors are betting that the market for offensive security tools is ripe for automation, moving from a service-heavy, project-based model to a software-defined, continuous one.
The company’s stated trajectory involves moving from proving the agent’s core hacking capability to building the platform around it. This includes the orchestration layer for scheduling and scoping tests, the reporting dashboard for security teams, and integration hooks for ticketing systems to track remediation.
| Aspect | Detail |
|---|---|
| Headquarters | London, UK |
| Founded | 2026 |
| Founder & CEO | Paul Price |
| Funding (Pre-seed) | $4 million (October 2026) |
| Lead Investor | Osney Capital |
| Target Customers | Banks, Financial Institutions |
The Scale and Skepticism Test
For an infrastructure reporter, the most interesting question is how this system behaves at scale. The technical breakdown is less about the AI and more about the operational envelope. An agent that can chain exploits across a technology stack must have a sophisticated understanding of context and consequence. False positives that trigger incident response teams are a cost. False negatives that miss critical paths are a failure. The system’s reliability in distinguishing between a successful proof-of-concept and an action that could cause operational disruption will define its enterprise readiness.
The sober assessment points to two primary friction points. First, the legal and contractual landscape. Enterprises will require ironclad service agreements defining the rules of engagement before unleashing an autonomous attacker on their production networks. Second, the competitive response. Established security testing firms and next-generation vulnerability management platforms will not cede this ground. They will either build similar automation or argue that the human intuition of a seasoned penetration tester is irreplaceable for finding business-logic flaws that an AI might miss.
CodeWall’s bet is that continuous, automated offense is a necessary evolution in a world where attack surfaces are dynamic and human-led tests are too infrequent. The early demonstrations against top-tier targets prove the agents can find and exploit real weaknesses. The next twelve months will test whether they can do it reliably, safely, and within the guardrails that regulated financial institutions demand.
Sources
- [GlobeNewswire, October 2026] CodeWall Emerges from Stealth with $4M to Give Every Enterprise an Attacker of Its Own | https://www.globenewswire.com/news-release/2026/10/14/3380641/0/en/codewall-emerges-from-stealth-with-4m-to-give-every-enterprise-an-attacker-of-its-own.html
- [Unite.AI, October 2026] CodeWall Raises $4M Pre-Seed to Bring Autonomous Attack Agents to Enterprise Security | https://www.unite.ai/codewall-4m-pre-seed-autonomous-attack-agents/
- [SiliconANGLE, October 2026] Offensive security startup CodeWall launches with $4M for AI agents that attack enterprises | https://www.siliconangle.com/2026/10/14/offensive-security-startup-codewall-lunches-with-4m-for-ai-agents-that-attack-enterprises/
- [New Claw Times, April 2026] Hacker CodeWall exposes Bain & Co’s AI vulnerability a month after similar attack on consulting firm McKinsey | https://www.afr.com/companies/professional-services/bain-vulnerability-exposed-by-hacker-a-month-after-mckinsey-20260420-p5zpe8
- [cfotech.co.uk, October 2026] CodeWall raises USD $4 million to test cyber defences | https://www.itbrief.co.uk/story/codewall-raises-usd-4-million-to-test-cyber-defences
- [Bloomberg, retrieved 2026] Paul Price, Morgan Stanley Investment Management Ltd: Profile and Biography | https://www.bloomberg.com/profile/person/3030104