Mindgard Secures $30M to Reinforce AI Security After Uncovering Critical Vulnerabilities

A Lancaster University spinout just demonstrated that Cursor can be made to run arbitrary code, that ChatGPT's image-generation guardrails can be bypassed, and that data can be leaked across trust boundaries in Google Antigravity — and walked away with $30M in Series A funding to keep doing exactly that.

That is the clearest signal in 2026 that "AI security" has stopped being a conference track and started being a procurement line item.

The receipt

The headline numbers, for the record:

• $30M Series A led by Album VC, with Karma Ventures joining as a new investor and .406 Ventures, Atlantic Bridge, IQ Capital, and Lakestar returning.
• Total raised now sits at roughly $42M, up from about $11.9M in a 2023 seed round and a December 2024 Series A tranche.
• More than 150 vulnerabilities disclosed across AI products since founding.
• Two of Mindgard's main competitors were acquired in the past year — the field is consolidating fast.
• The broader AI security market is projected to reach $56.5 billion by 2033.

The disclosed findings are the part that matters for anyone shipping AI-powered software today. Researchers found a way to make Cursor's AI-powered editor run any code without phishing links or malware. The same team bypassed ChatGPT's image-generation guardrails. They also leaked Google Antigravity data across trust boundaries. All three were disclosed through responsible channels — Cursor, OpenAI, and Google all had notice before the public did.

If your stack contains any of those three products — and most modern dev shops have at least one — this is your problem now, not theirs.

Operationalising expertise is the right frame

Most "AI security" tools are static checklists dressed up as dashboards. Mindgard's CEO James Brear put the distinction bluntly in the funding announcement: "We don't just automate attacks. We operationalize expertise, turning the knowledge of leading AI security researchers and offensive security practitioners into the capabilities every enterprise needs to secure their AI."

That is not marketing fluff. The platform is built on more than a decade of research by Dr. Peter Garraghan at Lancaster University — Mindgard's chief science officer. The company itself was founded in 2022 inside what it describes as the world's largest AI security academic lab, and only pivoted to enterprise sales when Brear (ex-Swimlane, Veriflow, Procera) took the CEO seat in October 2025.

The platform runs ongoing, automated red-teaming against models, agents, and applications — simulating real attacker behaviour rather than checking boxes. It does three concrete things:

1. Finds unmonitored "shadow AI" — the copilots, internal GPTs, and embedded models your security team doesn't know about.
2. Tests deployed systems for vulnerabilities against the same techniques an attacker would use.
3. Monitors AI applications in production for regressions and new attack vectors.

That third point is the one most teams skip. They pen-test once, ship, and forget. Mindgard treats AI security as continuous — which it has to be, because every model update is a fresh attack surface.

The market is consolidating faster than the buyers are

The $56.5 billion 2033 projection is large enough to be meaningless on its own. What matters is what is already happening around it.

Two of Mindgard's main competitors were acquired in the past year. Buyers are paying enterprise prices for AI red-teaming capability. CISOs who couldn't get budget for "AI security" in 2024 are getting it approved in 2026. The shape of the field looks a lot like cloud security did in 2017 — fragmented today, three or four platforms dominating by 2029.

For builders, this means the question is no longer "should we care about AI security?". The question is "which platform do we want to be on when our auditors ask?".

How to actually use this today

There is no public self-serve signup flow for Mindgard — it is enterprise sales. But you can act on the news without waiting for a procurement cycle.

Audit your AI footprint this week. Shadow AI is the largest surface most teams underestimate. A starting point:

# Find every AI SDK in your monorepo
grep -rE "(openai|anthropic|google\.generativeai|cohere|mistralai)" \
  --include="*.{ts,tsx,js,jsx,py}" \
  -l .

If your security team cannot name every model call, every embedded assistant, and every third-party GPT integration in production, that is your first finding.

Pen-test the tools you already use. The Cursor finding is reproducible. So is the ChatGPT guardrail bypass. Run your own red-team exercises against the AI features in your product before someone else does. Public AI threat catalogues exist for teams that want to start without a vendor.

Treat model updates as security events. Every time Cursor ships a new agent capability, every time OpenAI updates ChatGPT's system prompts, every time Google updates Antigravity — that is a new attack surface. Subscribe to vendor security advisories the same way you subscribe to CVE feeds.

Talk to Mindgard if you're shipping AI features at scale. Expect an enterprise demo, integration with your MLOps stack, and a continuous red-teaming contract measured in weeks, not days.

The full disclosure details for the three findings — Cursor, ChatGPT, and Google Antigravity — are in the original Tech Funding News piece if you want the technical specifics before you brief your team.

What this enables for builders

If you are a startup founder reading this, the temptation is to ignore it — you are too small to be a target. Wrong. Most of the 150+ vulnerabilities Mindgard has found were not in OpenAI or Google. They were in mid-sized products whose developers assumed nobody was looking.

The enable is simpler than the market cap suggests: as AI becomes the default interface layer, security becomes a feature. The companies that ship AI products with verifiable safety claims will outcompete the ones that ship AI products and hope. Mindgard's existence — and the $30M check — is the market signal that buyers are ready to pay for the verifiable part.

For larger teams, the enable is even more direct: a continuous red-teaming partner means you stop owning the expertise yourself. Mindgard's whole pitch is that they operationalise expertise you cannot hire. That is a real line item, not a vibe.

The part that does not change when the tooling does

Mindgard's tool finds vulnerabilities. Your component layer ships the product. The two are coupled — every UI surface that touches an AI endpoint is a potential leak path, every abstraction that hides where data flows is a potential trust-boundary violation.

A component that looks and behaves the same on web, iOS, and Android — one API, predictable data flow, no hidden re-renders or state syncs — gives you a smaller, easier-to-audit surface. When Mindgard's researchers or your own red team find a flaw, you fix it once. The fix lands on every platform because the components are the same. Convention beats configuration; identical surfaces beat divergent ones.

That is the part that survives the next model update, the next acquisition, and the next $30M round.

The takeaway

AI security has stopped being a future problem. A team has already broken the three AI products most teams use daily, the market is consolidating around four platforms, and a $56.5B 2033 projection means the procurement conversations are coming whether you are ready or not.

Audit your AI footprint. Subscribe to the vendor advisories. Talk to Mindgard if you are shipping at scale. And build on a foundation that does not change when the model does.