Mindgard Secures $30M to Reinforce AI Security After Uncovering Critical Vulnerabilities

A Lancaster University spinout just demonstrated that Cursor can be made to run arbitrary code, that ChatGPT's image-generation guardrails can be bypassed, and that data can be leaked across trust boundaries in Google Antigravity — and walked away with $30M in Series A funding to keep doing exactly that.

That is the clearest signal this year that "AI security" has stopped being a conference track and started being a procurement line item. And unlike most funding stories, this one arrives with receipts: the round, the investor lineup, and the vulnerability disclosures are all documented in the Tech Funding News report on the raise, cross-checked below against Mindgard's own site.

The receipt

The headline numbers, for the record — all per the TFN report:

• $30M Series A led by Album VC, with Karma Ventures joining as a new investor and .406 Ventures, Atlantic Bridge, IQ Capital, and Lakestar returning.
• Total raised now sits at nearly $42M, up from about $11.9M in a 2023 seed round and a December 2024 tranche.
• More than 150 vulnerabilities disclosed across AI products since founding, held in the company's threat database as proof of work.
• The broader AI security market is projected to reach $56.5 billion by 2033 — a number large enough to be meaningless on its own, and discussed as context rather than thesis below.

The disclosed findings are the part that matters for anyone shipping AI-powered software today. Researchers found a way to make Cursor's AI-powered editor run any code without phishing links or malware. The same team bypassed ChatGPT's image-generation guardrails and leaked Google Antigravity data across trust boundaries. All three were disclosed — Cursor, OpenAI, and Google have the findings, per the report.

If your stack contains any of those three products — and most modern dev shops have at least one — this deserves an hour of your security review this week, not a bookmark for later. Our app-security checklist is the place to start that review.

Operationalising expertise is the right frame

Most "AI security" tools are static checklists dressed up as dashboards. Mindgard CEO James Brear put the distinction bluntly in the funding announcement, and the quote is worth printing in full: "AI is creating an entirely new attack surface, and organisations need a fundamentally different approach to securing it. We don't just automate attacks. We operationalize expertise, turning the knowledge of leading AI security researchers and offensive security practitioners into the capabilities every enterprise needs to secure their AI."

That is not marketing fluff, because the lineage backs it. The platform is built on more than a decade of research by Dr. Peter Garraghan at Lancaster University — now Mindgard's chief science officer. The company was founded in 2022 inside what it describes as the world's largest AI security academic lab, and moved from research to enterprise sales when Brear — previously at Swimlane, Veriflow, and Procera — took the CEO seat in October 2025.

The platform runs ongoing, automated red-teaming against models, agents, and applications — simulating real attacker behaviour rather than checking boxes. It does three concrete things:

1. Finds unmonitored "shadow AI" — the copilots, internal GPTs, and embedded models your security team doesn't know about.
2. Tests deployed systems for vulnerabilities against the same techniques an attacker would use.
3. Monitors AI applications in production for regressions and new attack vectors.

That third point is the one most teams skip. They pen-test once, ship, and forget. Mindgard treats AI security as continuous — which it has to be, because every model update is a fresh attack surface. The TFN piece illustrates it with a bank launching a customer chatbot: check for prompt injection and data leaks before launch and after, because the model behind the chatbot will change under you.

The market is consolidating faster than the buyers are

Forget the 2033 projection. What matters is what is already happening around it — and here the TFN report supplies specifics, not vibes. Lakera, the Zurich team behind the Gandalf prompt-injection game, raised $30M before being acquired by Check Point in September 2025. Protect AI secured $60M at a reported $400M valuation before its acquisition by Palo Alto Networks. HiddenLayer raised $56M backed by Microsoft's M12 and IBM Ventures. Buyers are paying enterprise prices for AI red-teaming capability, and the field is consolidating the way cloud security did a decade ago — fragmented today, a handful of platforms dominating within a few years.

For builders, this means the question is no longer "should we care about AI security?" The question is "which platform do we want to be on when our auditors ask?" CISOs who couldn't get budget for "AI security" two years ago are getting it approved now. Mindgard's pitch — offensive research that is harder to copy than another guardrails dashboard, sold to financial services, pharma, gaming, semiconductors, and healthcare — is built for exactly that procurement conversation.

How to actually use this today

There is no public self-serve signup flow for Mindgard — it is enterprise sales. But you can act on the news without waiting for a procurement cycle.

Audit your AI footprint this week. Shadow AI is the largest surface most teams underestimate. A starting point:

# Find every AI SDK in your monorepo
grep -rE "(openai|anthropic|google\.generativeai|cohere|mistralai)" \
  --include="*.{ts,tsx,js,jsx,py}" \
  -l .

If your security team cannot name every model call, every embedded assistant, and every third-party integration in production, that is your first finding.

Pen-test the tools you already use. The Cursor finding is reproducible in shape, even if the exact exploit is patched. Run your own red-team exercises against the AI features in your product before someone else does. Public AI threat catalogues exist for teams that want to start without a vendor — and Mindgard's own 150-disclosure database is the argument that the catalogues are load-bearing, not theoretical.

Treat model updates as security events. Every time your editor ships a new agent capability, every time your model provider updates system prompts, every time a platform like Antigravity changes a trust boundary — that is a new attack surface. Subscribe to vendor security advisories the same way you subscribe to CVE feeds. Our production shipping checklist bakes this into the release process rather than leaving it as folklore.

Talk to Mindgard if you're shipping AI features at scale. Expect an enterprise demo, integration with your MLOps stack, and a continuous red-teaming contract measured in weeks, not days.

What this enables for builders

If you are a startup founder reading this, the temptation is to ignore it — you are too small to be a target. Wrong. Most of the 150+ vulnerabilities Mindgard has disclosed were not in OpenAI or Google. They were in mid-sized products whose developers assumed nobody was looking.

The enable is simpler than the market cap suggests: as AI becomes the default interface layer, security becomes a feature. The companies that ship AI products with verifiable safety claims will outcompete the ones that ship AI products and hope. Mindgard's existence — and the $30M check — is the market signal that buyers are ready to pay for the verifiable part.

For larger teams, the enable is even more direct: a continuous red-teaming partner means you stop owning the expertise yourself. Mindgard's whole pitch is that they operationalise expertise you cannot hire. That is a real line item, not a vibe.

The part that does not change when the tooling does

Mindgard's tool finds vulnerabilities. Your component layer ships the product. The two are coupled — every UI surface that touches an AI endpoint is a potential leak path, every abstraction that hides where data flows is a potential trust-boundary violation.

A component that looks and behaves the same on web, iOS, and Android — one API, predictable data flow, no hidden re-renders or state syncs — gives you a smaller, easier-to-audit surface. When red-teamers or your own team find a flaw, you fix it once. The fix lands on every platform because the components are the same. Convention beats configuration; identical surfaces beat divergent ones.

That is the part that survives the next model update, the next acquisition, and the next $30M round.

The takeaway

AI security has stopped being a future problem. A team has already broken three AI products that modern teams use daily, disclosed them, and raised $30M on the proof. The market is consolidating — Lakera to Check Point, Protect AI to Palo Alto — and the procurement conversations are coming whether you are ready or not.

Audit your AI footprint. Subscribe to the vendor advisories. Talk to Mindgard if you are shipping at scale. And build on a foundation that does not change when the model does: browse the OTF templates.

Sources

• Tech Funding News — Mindgard lands $30M after breaking Cursor, ChatGPT, and Google guardrails: round size, investor lineup, funding history, the three vulnerability disclosures, the Brear quote, founding lineage, and competitor acquisition details.
• Mindgard — official site: the company's own description of its automated AI red-teaming platform; cited for what Mindgard is and does.