"Your Defenses Need an Adversary": CodeWall Raises $4M to Give Every Enterprise Its Own AI Attacker

A London Startup Announces It Will Give Every Enterprise "a Hacker of Its Own"

On October 14, London-based offensive security startup CodeWall emerged from stealth with an official announcement via GlobeNewswire: a $4 million pre-seed round led by Osney Capital, with participation from InReach Ventures, Antler, and angel investors.

Its homepage carries a single line: "Your defenses need an adversary." Below it, a banner: "We've raised $4M. To give every enterprise an attacker of its own."

What the company sells is what it calls the "offensive layer" for enterprise security: multiple AI agents that attack a company the way a real external hacker would — starting from zero credentials, zero source code, zero privileged access — working together to verify, on an ongoing basis and within the customer's authorized scope, which attack paths are genuinely exploitable.

The pitch is blunt: replace the penetration test most enterprises commission once or twice a year. Founder and CEO Paul Price says enterprises shouldn't have to wait for a real attacker to learn whether their defenses hold. He describes this continuous testing as a "permanent capability" rather than a periodic assessment.

How It Works: Specialist Agents Plus a Shared Investigation Graph

CodeWall's architecture will look familiar to anyone who builds multi-agent systems — except it's pointed at the attack side:

Each engagement spins up several specialist agents at once, each with its own job — recon finds the exposed surface, intrusion wins the foothold, lateral movement escalates privileges and pivots. The key design is the layer in the middle: everything one agent discovers goes into a shared "persistent investigation graph," becoming the route another agent follows deeper. A weakness in one application can become the starting point for a path into connected systems, identities, and data.

What the customer sees is not a pile of CVEs but a complete, reproducible attack path: where the attacker got in, how they moved, what they reached — every step backed by evidence. And the cadence matters most: when new systems come online, applications change, or fixes ship, the agents come back and retest — strictly within the scope the customer authorized.

That "authorized scope" qualifier appears more than once in the official release. It is the lifeline of the entire business model — more on that below.

Why Now: The Attackers Got AI First

CodeWall's argument is simple: AI has made it possible to automate entire attack chains, and the attackers got there first.

SiliconANGLE's coverage notes that over the summer, cloud security company Sysdig documented what it said was the first ransomware operation run from start to finish by an autonomous AI agent. Automated attack is not "the future" — it is "this summer."

Paul Wilkes, Partner at Osney Capital, put it this way in the announcement: "For years, the advantage has sat with the attacker. They can keep probing, adapting and looking for another way in, while enterprises defend an environment that never stops changing." He sees an opportunity to flip that dynamic, and believes there is a future where "having an attacker working for you is as fundamental as having defenses in place."

The funding will go toward expanding where the agents can operate across the enterprise, building out verification and remediation workflows, and hiring across offensive security, engineering, customer success, and go-to-market in London.

The Track Record: Production Database Access at McKinsey's AI Platform in Two Hours

The most eye-catching part of the announcement is CodeWall's "live demo" from earlier this year: it turned its agents on the Big Three consulting firms — McKinsey, Boston Consulting Group, and Bain.

The headline finding: an agent with no credentials gained read and write access to the production database behind McKinsey's Lilli AI platform within two hours. Research published in the following weeks also found exposed databases at BCG and Bain.

All three firms fixed the flaws within days of being notified. A McKinsey spokesperson told The Register that a third-party forensics investigation found no evidence client data had been accessed by CodeWall or any other unauthorized party — the responsible-disclosure ending this kind of story should have.

Banks are already customers. Raghu Valipireddy, SVP and CISO at Axos Financial, said in the announcement that they are working with CodeWall to bring autonomous offensive security into their security program, "helping us test our applications more frequently and from an attacker's perspective."

Drawing the Line with XBOW: Bounty Hunter vs. Resident Red Team

Readers of this site may remember our cycle65 story on XBOW: an AI agent that assembled a complete Chrome exploit chain (V8 → WebP → Crashpad) in six days and collected Google's first $250,000 payout under its new bounty rules. That story's conclusion: the cost of attack is collapsing.

CodeWall and XBOW are two sides of the same trend, but they are entirely different things, and the distinction matters:

XBOW was an event; CodeWall is a product. XBOW proved that "AI can attack" — one agent chaining a full exploit path inside a public bug bounty program, a one-off, pay-per-bug hunter. CodeWall wants to turn "AI attacks" into a purchasable continuous service: not bounty payouts, but a resident red-team subscription for the enterprise.

Different targets. XBOW aimed at public bounty programs (Google's Chrome rewards); CodeWall aims at the enterprise's own assets, continuously probing within the customer's authorized scope. One hunts in the wild; the other is a wolf hired to guard the house.

Different time horizons. The XBOW story was about "six days"; CodeWall's story is about "permanent" — come back when systems change, come back when fixes ship. One is a snapshot; the other is monitoring.

If XBOW proved the collapse of attack cost, CodeWall is betting on the other half of the proposition: the cost of defensive testing has to collapse too. Twice-a-year human pentests can no longer keep pace with automated offense.

Three Takeaways for Indie Developers

This news is closer to solo developers than it looks — the thinking ports down directly:

1. Before you ship, let an agent hack you first. You don't need CodeWall's enterprise tier to get the idea: next time vibe coding produces an app with login, payments, or file uploads, open a dedicated agent session before deploying with the prompt "assume you're an attacker with zero credentials; find exploitable paths in this app." You'll be surprised what it finds — broken access control, IDOR, exposed debug endpoints — exactly the things "builder mode" is blind to.

2. Move security testing from "annual checkup" to "continuous monitoring." CodeWall's "retest whenever something changes" is worth copying: indie projects can add an agent security review to CI that runs automatically whenever auth, APIs, or dependencies change. The cost is already low enough for solo developers — what's missing is the habit.

3. Specialist agents beat one "do-everything" agent. CodeWall's architecture — recon / intrusion / lateral movement separated, sharing a graph — applies to writing code too: give one agent the dedicated job of "finding fault" instead of asking the builder agent to "self-review." An attacker and a builder running on the same brain will always grade their own homework generously. Security learned this long ago; vibe coding should learn it too.

The Risks: The Least-Discussed Part of "Permanent Penetration"

Save the criticism for last, because these are also the questions CodeWall most needs to answer.

Authorized scope is the lifeline — and the biggest risk. "Permanent penetration" means a machine is continuously probing around your systems. Scope creep — an agent's "curiosity" wandering one step past authorization — is technically almost inevitable and legally potentially catastrophic. CodeWall writes "within the authorized scope" into every sentence of its announcement, which shows awareness, but there is no public detail on what the enforcement guardrails look like.

Dual-use technology has no innocent version. An agent system that can break into an enterprise from zero credentials is an attack tool with a different authorization letter. Tools aren't guilty; uses are tiered — a judgment we applied before when discussing reverse-engineering tools, and it applies here just as well. But "continuous, purchasable, automated offensive capability" spreading widely is itself a change in the security landscape. Who buys it and who it's sold to are questions regulators will ask sooner or later.

The security of the attack agents themselves. An agent system permanently running attack missions is a high-value target: prompt-injection counterattacks, graph poisoning, a hijacked agent turning on its own customer. These aren't science fiction; they're entrance-exam questions for this business. CodeWall has published nothing on this part of the design.

The enemy of continuity is noise. Twice-a-year pentests suffer from slow cadence; continuous testing risks drowning the security team in low-value alerts until they switch it off. CodeWall's emphasis on "verified attack paths plus evidence" points the right way — the survival line for continuous testing isn't "find more," it's "report accurately."

Closing: After Attack Cost Collapses, Defensive Testing Is Next

Read the two stories together and October 2026's security picture is clear: XBOW proved an AI attacker can assemble a full Chrome exploit chain in six days; Sysdig documented an AI-executed ransomware operation end to end; and CodeWall, with $4 million, says the defenders should have one too.

"Give every enterprise an attacker of its own" sounds like a paradox, but the logic holds: when attack becomes automated and continuous, defensive testing has to be automated and continuous. A twice-yearly human pentest doesn't measure the real world's attack cadence — it measures the budget cadence.

The $4 million pre-seed buys a bet: that "having an attacker working for you" will one day be as fundamental as having defenses in place. Whether the bet pays off depends on CodeWall answering the four risk questions above. But the direction itself — AI agents moving from "writing code" to "attacking code" to "attacking your code on your behalf" — is already underway.

For vibe coders, the most direct action item is a single line: before your next deploy, let an agent hack you first. It's free, and you can do it today.