"One model reads untrusted input; another one acts. Never both." That's point 4 of Bessemer's twelve-point agent-security thread. Point 9, five rules later: "Put an AI reviewer on every PR... Two models are better than one."
Read those back to back and you notice something. This isn't a philosophy of agent safety. It's a shopping list.
Last week I flagged the Bessemer peer-set-instrumentation thread as an open signal — a VC firm reportedly gathering insights from 20-plus AI-native engineering teams and turning what they found into rules. This week the full framework landed: 63 pages, "The Agentic Awakening" by, reportedly, Liran Eshel and Adam Fisher. And within roughly the same period, per the funding disclosures, roughly $193M in fresh capital reportedly landed on companies selling exactly those rules.
Governance stopped being a thesis and became a category with a procurement checklist.
Governance stopped being a thesis and became a category with a procurement checklist. The trouble is the money is buying two structurally different bets.
The trouble is that the money is buying two structurally different bets, and they don't fail the same way. The one investors are crowding into is the weaker one.
Start with the big check. CodeRabbit raised $143M at a $1.5B valuation, co-led by Atomico and Smash Capital, with strategic money from BMW i Ventures and Datadog — both also customers. The company runs 2 million code reviews a week across 17,000 customers including Nvidia and JFrog. Revenue up more than 5x year over year.
That's a real business. What it's selling is Bessemer point 9 rendered as product: put an AI reviewer on every PR, because two models are better than one.
Now look at the data CodeRabbit itself leans on to justify the raise. LinearB's 2026 benchmarks, drawn from 8.1 million pull requests across 4,800 teams, show AI-generated PRs getting a 32.7% acceptance rate versus 84.4% for human-written ones.
Teams with high AI adoption merge 98% more pull requests — while spending 91% more time on review to do it. Agentic PRs wait 5.3x longer for pickup.
Read that as an operator, not a marketer. The pipeline isn't broken at generation. It's jammed at the gate, and the jam worsens as AI volume rises.
CodeRabbit's answer is to add another model at that gate. And here's the structural problem the valuation glosses over: a model reviewing a model is not independent judgment. It's correlated judgment.
The same distributional blind spots, the same training biases, the same failure to reason about intent that let a bad AI-generated PR through are shared, to some meaningful degree, by the AI reviewing it. When the writer hallucinates a nonexistent npm package — and nearly 20% of AI-recommended packages don't exist, per a USENIX study across 576,000 samples and 16 models — the reviewer trained on the same internet may not blink.
"Two models are better than one" is true only when the two models fail for different reasons. Stack two correlated judges and you don't double your safety margin. You scale the same failure mode you were hired to catch, and you do it at 2 million reviews a week.
That doesn't make CodeRabbit worthless. Its Triage feature — sorting PRs across eight signals into risk bands so senior engineers see the dangerous diffs — is genuinely useful queue management. But queue management is a feature, and features get absorbed.
GitHub already ships Copilot PR approval. Datadog is both an investor and a customer. When the review layer is a model call bolted onto a PR, the platform that owns the repo, the pipeline, and the observability stack can fold it in. The moat is shallow because the primitive — call a second LLM at the gate — is something every platform vendor can replicate.
Now the quieter bet. AIR Security walked out of stealth on September 1 with $50M, closing two rounds inside six months — Sequoia's initial $10M, then Greenoaks' $40M — for a company founded only in February by two veterans of Israel's offensive cyber units.
The angel list tells you what kind of bet this is: Anne Neuberger, the former US deputy national security adviser for cyber, alongside operators from Wiz, Cognition, Eon and Clay.
AIR isn't grading a model's output. It sits at the point where an agent ingests a tool — a skill, a plugin, an MCP server — and evaluates it for malicious instructions, excessive permissions, and supply-chain risk before the agent wires it into a task.
That's Bessemer point 7 turned into product: allow-list tools and destinations, broker short-lived access so agents never see secrets, treat the tool surface as the attack surface. It's also point 4's other half — keep untrusted intake away from the thing that acts.
The critical difference is how it fails. A tool allow-list, a version pin, a brokered credential, an egress restriction — these are deterministic controls. They fail closed. They don't depend on a second model being right about anything.
CodeRabbit's safety improves only if the reviewer model happens to be smart enough in the moment. AIR's safety holds because an un-allow-listed MCP server simply doesn't get to run, no matter how persuasive its hidden instructions are.
That's the whole game. The durable controls are the boring, deterministic ones that don't route safety through a probabilistic judgment. Bessemer says as much in point 5, in the one line that reads less like marketing than the rest: "The architectural layer (dual-LLM, capability scoping, human-in-loop) is the durable defense."
Which is why the investment call inverts the funding weight. The $143M bet is buying a feature that platform vendors will absorb; the $50M bet is buying a control plane that sits at the identity-and-tool layer where a standalone company can actually defend a perimeter.
AIR isn't alone there — Zenity, Noma, Astrix and Operant are crowding the same control-plane race, and even they concede the open question is whether a standalone plane becomes default before the platforms fold the guardrails in. That's a real risk. But it's a distribution race in a defensible layer, not a features race in an absorbable one.
And notice where AIR's early pull comes from: 20-plus customers at launch, strongest in financial services and pharma, where an agent overstepping its bounds is measured in fines. Regulated buyers don't purchase "a smarter reviewer." They purchase controls that fail closed and produce an audit trail.
Then there's the demand curve, arriving before either bet is proven. DocuSign's CEO Allan Thygesen: "Many tens of thousands of customers have access to this now. And you can absolutely build an agent to execute a simple contract."
Sit with "simple contract." The signing was never the hard part — the hard part is the judgment call about which contracts are actually simple, the reconciliation, and who's accountable when an agent misreads intent. Most simple agreements have one clause that isn't.
That is the exact gap between the two bets. When an agent gets contract-execution authority, "have a smarter model check its work" is the reassurance. "The agent physically cannot touch a tool or credential outside its allow-list" is the control.
The money this week says the market has agreed governance is fundable. It hasn't yet agreed on which layer holds. Bet on the one that doesn't need a second model to be right.