Hex Security

Hex Security (Y Combinator Winter 2026, San Francisco) builds autonomous AI agents for offensive security. Instead of a once-a-year manual penetration test, its agents run continuously against a customer's web applications, APIs, and infrastructure, reasoning like elite security researchers to discover and chain attack paths across the full attack surface. Every finding is validated with a working proof-of-concept, which the company says eliminates false positives, and is delivered with reproduction steps and remediation guidance. In its launch the company reported that its agents found critical vulnerabilities across dozens of well-known YC companies, including SQL injection exposing billions of records and a demonstrated proof-of-concept worm, estimating more than 3 billion dollars in prevented damages. The founding team includes Huzaifa Ahmad, Ahmad Khan, and Prama Yudhistira, with backgrounds at PlayAI, AWS, and OpenAI. The product operates at the domain hex.co and is distinct from the Hex notebook company at hex.tech.