CodeWall AI Penetration Testing Launches, Putting Continuous Attack Agents Inside Enterprise Security

CodeWall launched its AI penetration testing platform with $4 million in pre-seed funding and a pointed challenge to traditional enterprise security reviews. Instead of waiting for an annual assessment, the London startup wants autonomous agents to keep searching for ways into customer systems.

The pre-seed announcement presents those agents as controlled attackers working for the defender. Osney Capital led the round, with InReach Ventures, Antler, and angel investors participating.

That framing puts CodeWall against more than conventional vulnerability scanners. Its real opponent is periodic, human-led penetration testing, which provides deep expertise but only a temporary view of a changing environment.

CodeWall says its system starts without credentials or internal knowledge. Specialized agents investigate the target concurrently, share discoveries, and assemble attack paths across connected applications and infrastructure.

The claim is significant because enterprises already buy scanners, exposure-management platforms, red-team exercises, and penetration tests. CodeWall must show that another offensive layer reveals exploitable paths those controls miss without introducing unacceptable operational risk.

Its agents also enter an increasingly competitive market. XBOW, Horizon3.ai, Pentera, and other vendors are already arguing that automated testing should become a continuous security function.

The funding therefore matters less as a large financing event than as evidence of a broader shift. Investors and security teams increasingly treat autonomous offensive testing as a product category, not simply an experimental use of language models.

CodeWall AI Penetration Testing Turns an Audit Into a Standing Capability

CodeWall’s central bet is that an enterprise needs an authorized attacker running repeatedly, not a report that begins aging immediately.

A conventional penetration test gives skilled operators a defined scope and testing window. They examine applications or infrastructure, validate selected weaknesses, and deliver findings that teams can remediate.

That process can uncover complex problems, especially when business logic or unusual workflows require human judgment. However, its conclusions describe the systems present during the engagement.

Cloud services, application releases, identities, and external assets keep changing afterward. A new deployment can create an attack path that did not exist when the assessment ended.

CodeWall says its attack agents return when infrastructure changes or teams apply a fix. That approach changes penetration testing from a scheduled project into a standing capability tied to the organization’s current environment.

The platform begins from an outsider’s perspective, according to the company’s attack-agent launch. Agents receive no credentials or prior knowledge unless the customer explicitly configures a different test.

Several agents then work on separate tasks. One might map exposed systems while another examines an application or tests whether a discovered weakness supports deeper access.

Their findings enter a shared investigation graph, which records assets, evidence, relationships, and attempted actions. An agent can use another agent’s discovery when constructing a longer attack chain.

That coordination is important because severe compromises often involve multiple ordinary weaknesses. An exposed credential might provide initial access, while excessive permissions and an injection flaw create the larger impact.

Traditional scanners usually present such issues as individual alerts. A coordinated offensive system instead tries to establish whether the issues combine into a viable route through the environment.

CodeWall says customers receive a step-by-step record of completed attack paths, including supporting evidence. The platform can also retest a remediated weakness rather than leaving verification to another manual engagement.

Its documentation lists web applications, APIs, Model Context Protocol servers, and large language model applications among supported targets. Model Context Protocol, or MCP, is a standard that lets AI systems connect to tools and external data.

Those targets reflect the expanding enterprise attack surface. Security teams now manage familiar web flaws alongside prompt injection, excessive agent permissions, exposed retrieval systems, and unsafe tool connections.

CodeWall also supports connections with Jira, ServiceNow, Linear, Azure DevOps, cloud platforms, and asset-management services. Change triggers can start new tests when monitored infrastructure changes.

The result resembles a security feedback loop. The platform searches for a working path, produces evidence, sends the finding into remediation workflows, and then tries the path again.

That model does not eliminate human work. Security teams still decide what can be tested, investigate business impact, coordinate fixes, and accept residual risk.

It does, however, shift scarce human attention. Practitioners can spend less time repeating reconnaissance and more time reviewing meaningful attack evidence or examining ambiguous results.

CodeWall plans to use much of the funding to expand the environments its agents can reach. It is also building more workflows for verifying findings and helping customers manage remediation.

The startup is hiring technical and commercial staff in London. Its near-term challenge is turning a compelling attack demonstration into dependable enterprise operations across varied customer systems.

Why Autonomous Offensive Security Is Attracting Capital Now

AI is increasing the speed of both software creation and offensive experimentation, making occasional security validation harder to defend as the default.

Development teams can ship infrastructure and application changes several times between formal assessments. AI coding systems can increase that output while also reproducing insecure patterns at scale.

Attackers gain similar leverage. An AI agent can enumerate targets, interpret responses, choose tools, and revise its approach without waiting for a person to direct every command.

That does not mean current agents can replace experienced operators across every engagement. It means automation can reduce the cost of repeatedly attempting the early and middle stages of an attack.

The market has already rewarded that thesis. XBOW announced substantial funding to expand AI pentesting, while Horizon3.ai has built a large business around its NodeZero autonomous testing platform.

Horizon3.ai said in August that NodeZero had run 310,000 production security tests without disruptions. That figure remains a company-reported metric, but it sets an operational benchmark for newer entrants.

The company’s funding and reported production history also show what CodeWall faces. A startup entering this category must compete on more than the general promise that agents can find vulnerabilities.

CodeWall differentiates its approach through multiple cooperating agents and an outside-in starting point. It argues that these agents can link discoveries across an enterprise instead of executing a fixed scanning sequence.

The company also emphasizes attack proof. Finding outdated software or a suspicious endpoint is less valuable than showing whether an attacker can use it to reach sensitive systems.

This distinction separates autonomous offensive security from vulnerability assessment. A vulnerability scanner identifies potential weaknesses, while an offensive agent attempts controlled exploitation to establish practical impact.

The separation is not absolute. Modern exposure platforms increasingly validate findings, and established autonomous-testing vendors already construct attack paths.

CodeWall therefore enters a market with overlapping labels and increasingly similar promises. Buyers must compare target coverage, exploit depth, evidence quality, safety controls, and integration effort.

The funding round gives CodeWall time to broaden those capabilities. It does not resolve whether its multi-agent architecture will outperform larger platforms across diverse production environments.

Still, the timing is favorable. Boards and security leaders are asking whether their controls can withstand attackers who use AI, not merely whether they passed an earlier compliance exercise.

CodeWall’s investor case follows that concern. Osney Capital partner Paul Wilkes argued that attackers have historically benefited from continuous probing and that defenders need the same persistence.

That position treats offensive testing as infrastructure. An organization would operate it alongside preventive controls instead of purchasing it only before an audit or major release.

Enterprise demand will depend on whether buyers accept that model operationally. Continuous testing can produce value only when teams can prioritize findings, fix them, and distinguish new exposure from repeated noise.

The product must therefore succeed outside the attack itself. Ticketing, retesting, ownership, evidence retention, and exception handling will shape whether customers keep the system active.

These surrounding workflows are not administrative details. They determine whether autonomous discovery reduces security workload or creates another queue that teams cannot clear.

CodeWall Attack Agents Challenge the Annual Pentest Model

The decisive contest is continuous machine-led testing versus periodic human-led assessment, not machines versus security professionals.

Human penetration testers bring creativity, context, and the ability to recognize business consequences that automated systems can miss. They can question assumptions and adapt when an application behaves unpredictably.

They also work within finite budgets and schedules. A team cannot manually revisit every internet-facing asset whenever a developer changes a service or cloud permission.

CodeWall attack agents target that coverage gap. The system can repeat reconnaissance and validation without requiring a new consulting engagement for every change.

This approach is particularly relevant for companies with large external footprints. Acquisitions, forgotten subdomains, contractor systems, and temporary cloud resources can all create unexpected entry points.

A continuous agent can repeatedly inspect that perimeter. If it finds an exposed service, it can test whether the service connects to a more consequential resource.

The strongest evidence supporting CodeWall’s argument comes from research the company published before its commercial launch. Its agents examined AI platforms associated with McKinsey, Boston Consulting Group, and Bain.

At McKinsey, CodeWall said an agent gained read and write access to the production database behind the Lilli AI platform within two hours. The company began without credentials and worked under McKinsey’s vulnerability disclosure policy.

According to the Lilli disclosure, the agent identified exposed endpoints and exploited an SQL injection weakness. SQL injection manipulates database queries through unsafe application inputs.

McKinsey closed the relevant endpoints after notification. A spokesperson said a third-party forensic review found no evidence that CodeWall or another unauthorized party accessed client data.

That qualification matters. Finding a path to a database does not establish that sensitive records were extracted, misused, or exposed to an unrelated attacker.

The episode still illustrates the product’s intended role. An agent started externally, followed technical clues, and produced an attack chain that the affected organization could investigate and close.

CodeWall later reported vulnerabilities involving BCG and Bain systems. Its Bain research said the agent found hardcoded credentials in publicly served JavaScript within 18 minutes.

Those credentials allegedly provided an authenticated foothold. The agent then identified an SQL injection path and excessive database permissions, according to CodeWall’s account.

The Bain investigation was published by the vendor selling the testing platform. Readers should treat its performance claims as company evidence, not a neutral benchmark.

Even so, these cases are more useful than demonstrations on intentionally vulnerable labs. They show the type of ordinary configuration and application mistakes that can combine into substantial exposure.

The research also highlights why a scanner-versus-pentester comparison is incomplete. The valuable output was not simply a list of endpoints or a hardcoded credential.

The agents reportedly used each discovery to pursue a longer route. That attack-chain reasoning is the capability CodeWall must reproduce safely for customers, not merely in public research.

Human testers can perform the same reasoning and may do it better in difficult cases. CodeWall’s advantage would come from frequency, parallelism, and the ability to preserve knowledge between runs.

Its shared graph could help agents avoid restarting every investigation from zero. It could also reveal connections that become important only after another part of the environment changes.

Yet automation has limits. Business-logic vulnerabilities often require understanding what an application is supposed to permit, not simply which technical action succeeds.

Agents can also misinterpret responses, follow unproductive branches, or generate findings that look serious without meaningful business impact. Human review remains essential when evidence is ambiguous.

The likely near-term model is therefore complementary. Autonomous agents handle repeated surface mapping and validated attack paths, while experienced testers address sensitive workflows and novel scenarios.

That combination still pressures the annual testing model. If continuous systems reliably catch common attack paths, buyers will expect scheduled human engagements to focus on problems machines cannot resolve.

The Safety Tradeoff Is the Product Test

An authorized attacker is useful only when its scope controls remain stronger than its ability to improvise.

Offensive agents differ from passive monitoring tools because they take actions against live systems. Even a legitimate test can cause an outage, alter data, or trigger defensive processes.

CodeWall says customers define in-scope hosts and paths before a run. The agents are supposed to reject links or exploit chains that lead beyond those boundaries.

Its published scope controls include three testing depths. The standard mode avoids actions that could disrupt availability, while the light mode performs a narrower surface assessment.

A thorough mode permits deeper exploration but retains safety checks. The company says denial-of-service and data destruction are restricted by default.

Customers can also require approval before selected commands run. CodeWall records agent reasoning and intended commands, giving operators a log to inspect during testing.

These controls address an obvious concern, but documentation alone cannot establish their reliability. The relevant question is how they behave when agents encounter prompt injection, unusual redirects, shared infrastructure, and incomplete asset inventories.

Prompt injection is especially important for agents testing AI applications. Malicious content can instruct a model to ignore its original task or disclose information it should protect.

An offensive system could encounter instructions designed to redirect its actions. It must treat those instructions as hostile evidence rather than authorization.

CodeWall says its safeguards have received Adversarial Cyber Agent Proof certification. The framework evaluates scope adherence, prompt-injection resistance, destructive-action prevention, transparency, and resource discipline.

Certification provides an external test against defined criteria. It does not guarantee safe behavior across every production architecture or every future model update.

The broader field has already seen why caution is necessary. Autonomous security agents can pursue goals through paths their developers did not anticipate.

Production systems also contain dependencies that asset owners may not recognize. A customer might authorize a domain without realizing that a tested function invokes a shared service used elsewhere.

Logging can reduce uncertainty after an action, but it cannot undo an outage. Approval gates add control, although frequent prompts can undermine the autonomy buyers expect.

That creates a persistent tradeoff. Aggressive agents can discover deeper paths, while conservative agents reduce risk but may reproduce the shallow coverage of existing scanners.

CodeWall must prove that it can adjust this balance predictably. Security teams need to know what each depth level permits and which actions always require human consent.

They also need clear identity and access boundaries. Testing agents should receive only the credentials required for a particular engagement, with revocation and audit trails built into the workflow.

The company’s outside-in default reduces initial trust. However, later tests may use credentials to assess authenticated applications, internal systems, or post-compromise movement.

Enterprise procurement will examine data handling as closely as exploit capability. Attack evidence can include secrets, system details, employee identities, and information about defensive controls.

CodeWall must show how it isolates customer data, limits retention, protects logs, and prevents findings from becoming a new intelligence source for attackers.

Its MCP integration adds another boundary. The feature lets authorized AI assistants read pentest data and launch limited retests through scoped API keys.

That can help developers investigate findings from their existing tools. It also gives customers another interface whose permissions, tokens, and actions require careful governance.

Buyers should test the tester before enabling broad automation. A limited application scope can reveal how accurately the system respects boundaries and how often its evidence needs correction.

Teams should also measure disruption, false positives, duplicate findings, remediation time, and successful retests. Those operational results matter more than the number of vulnerabilities reported.

CodeWall’s public research demonstrates initiative and attack reasoning. Its commercial credibility will depend on uneventful production runs, clear controls, and useful findings across many customers.

A Crowded Market Raises the Proof Standard

CodeWall is not creating autonomous pentesting from scratch, so its launch must be judged against vendors with longer operating records and broader deployments.

Horizon3.ai markets NodeZero as an autonomous platform for testing infrastructure, identities, cloud environments, and attack paths. Its scale gives buyers a reference point for production maturity.

The company says its system can run against live environments without disrupting operations. Its recent production testing claims remain vendor-reported, but prospective buyers will still compare them with CodeWall’s record.

XBOW has emphasized AI-driven penetration testing and reproducible proof of exploitation. It also gained attention through bug-bounty performance, giving the company a public measure of vulnerability discovery.

Pentera approaches the market through automated security validation. Its platform tests whether existing defenses stop attack techniques across enterprise environments.

Other vendors combine human expertise with automated testing. That hybrid model can appeal to organizations that want continuous coverage without relying entirely on agent decisions.

CodeWall’s most visible distinction is its coordinated team of outside-in attack agents. The shared investigation graph is intended to turn separate findings into a coherent path through connected systems.

That architecture sounds useful, but customers need comparative evidence. A multi-agent system does not automatically produce deeper results than one well-designed agent or a mature deterministic platform.

More agents can also increase compute use, duplicated work, and operational complexity. The relevant outcome is validated risk found per unit of time and organizational effort.

The company’s research against consulting firms offers a strong narrative. However, selected public cases do not reveal performance across hardened targets, internal networks, legacy applications, or environments with mature exposure management.

Independent evaluations would help. Buyers need tests that use the same scope, starting information, time limit, and success criteria across competing systems.

They should also separate vulnerability discovery from compromise validation. A platform can report many weaknesses without constructing a path that reaches a meaningful asset.

Remediation quality is another differentiator. An attack finding should identify the path, affected controls, reproducible evidence, and the smallest change that breaks the chain.

Retesting must then confirm that the path no longer works. Simply checking whether an individual software version changed may miss an alternative route.

CodeWall’s integrations suggest it understands this requirement. Findings can enter common engineering and service-management systems rather than remaining in a standalone report.

Still, integration does not guarantee remediation. Security teams often struggle because ownership crosses application, identity, cloud, and infrastructure groups.

A shared attack graph might help assign work by showing how each weakness contributes to the final outcome. It might also overwhelm teams if every branch generates a separate ticket.

Customers should ask how CodeWall groups related findings and suppresses repeats. They should examine whether the platform preserves context when ownership moves between teams.

They should also verify how the system handles accepted risks. A continuous agent should not repeatedly escalate an acknowledged finding without new evidence or changed impact.

For developers, the most useful output may be a concise reproduction path tied to the relevant service and deployment. That turns an offensive discovery into actionable engineering work.

Organizations can retain those decisions in a searchable technical knowledge base. That record helps teams connect recurring findings with earlier fixes and system changes.

This operational layer will determine whether CodeWall becomes a daily control or an occasional demonstration. Enterprise security products succeed when their evidence changes behavior, not when their dashboards accumulate alerts.

The startup’s $4 million round is modest beside later-stage competitors. That can encourage focus, but it also limits how quickly CodeWall can expand integrations, support, compliance, and geographic coverage.

Its investors are effectively betting that a focused agent architecture can establish a defensible position before the category consolidates.

The pressure now shifts to measurable results. CodeWall needs reference customers that will discuss coverage, disruption, remediation speed, and repeatability rather than only endorse the concept.

What to Watch After the CodeWall Launch

The next phase will reveal whether CodeWall AI penetration testing becomes dependable security infrastructure or remains an impressive offensive demonstration.

The first signal is production evidence from named enterprise customers. CodeWall cites Axos Financial as an organization working with the company to add autonomous offensive testing to its security program.

A useful customer account would disclose the authorized scope, testing frequency, validated attack paths, and effect on remediation time. It should also describe any operational interruptions or false positives.

Those details would strengthen CodeWall’s case more than another isolated vulnerability story. They would show whether its agents perform consistently inside a governed enterprise program.

The second signal is broader target coverage. CodeWall says it will use the new capital to reach more areas of enterprise environments.

Support for internal networks, identity systems, cloud control planes, APIs, AI applications, and third-party services would make the platform more useful. It would also increase the safety burden.

Watch how CodeWall applies authorization boundaries across those environments. Deeper reach will strengthen the product thesis only if customers retain precise control over agent actions.

The third signal is competitive validation. Horizon3.ai, XBOW, Pentera, and hybrid testing providers will keep improving their own attack automation.

CodeWall must show that its cooperative agents find meaningful paths that other approaches miss. Transparent benchmarks or independent comparative testing would make that difference easier to evaluate.

A lack of such evidence would weaken the company’s central claim. Buyers would then have little reason to choose a new platform over vendors with longer production histories.

Security leaders do not need to accept or reject autonomous offensive security as a single category. They can begin with a narrow, disposable test environment and compare results against existing controls.

The evaluation should ask whether the agents found a reproducible path, respected scope, produced understandable evidence, and confirmed remediation without disruption.

Teams should also examine the human workload created by each run. A system that finds valid issues but consumes days of review may not improve the testing program.

CodeWall’s launch makes one point difficult to ignore: enterprise infrastructure changes too often for a yearly report to represent current exposure. Continuous testing is becoming a credible response.

The unresolved question is who can deliver it safely. CodeWall attack agents have already produced notable research, but enterprise trust requires a longer and quieter record.

For developers and security buyers, the practical next step is to define one controlled target and a measurable success standard. Then compare agent findings with scanner results and human testing.

If CodeWall can repeatedly expose consequential attack paths while staying inside those boundaries, its $4 million launch will mark more than another cybersecurity funding round. It will show that organizations can operate a persistent attacker as part of their own defense.