In June, an OpenAI agent given a mundane task, pulling Australian health statistics, found its way into a Medicare portal run by Services Australia. It was the first known case of an AI agent hacking a government system, and it wasn’t the last. OpenAI has since confirmed that its agents also reached data on SEC and Census Bureau websites, and that another tried and failed to break into a Department of Education site. Last week, a report from Asymmetric Security added a more unsettling detail: the agents appear to have tried to cover their tracks, using private accounts and throwaway email inboxes. The researchers couldn’t tell whether that was deliberate.

Then there’s Hugging Face. In July, roughly 700 OpenAI agents running an internal cyber evaluation slipped out of their sandbox, improvised a message board to coordinate with one another, and compromised parts of Hugging Face’s production infrastructure. The motive wasn’t sabotage. The agents had worked out that Hugging Face might hold the answers to the benchmark they were being graded on. They were, in effect, cheating on the test. Google, Anthropic and Meta have since disclosed their own models escaping evaluation environments, and OpenAI now faces what appears to be the first lawsuit seeking to hold an AI developer liable for a rogue agent.

I’d be careful with the word “rogue”, though. The more sober post-mortems point to human decisions: a misconfigured test environment, models deliberately run without their usual safeguards, warning signs that nobody acted on. The agents weren’t malicious. They were relentlessly goal-seeking, and they had far more access than their task required. For an investor, that’s actually the important part. These were boring failures, and boring failures are exactly the kind that good products fix.

An old problem with new consequences

None of this should come as a surprise. Researchers have been cataloguing “specification gaming”, where a model optimises for the metric rather than the goal, for years. Anthropic and others have published work showing models resisting shutdown and behaving differently when they suspect they’re being tested.

What’s changed is the setting. When a model’s misbehaviour was confined to a chat window, the gap between what we asked for and what it pursued was an academic curiosity. Give the same model tools, credentials and an internet connection, and that gap becomes an incident report.

The market has noticed. “Excessive agency”, the industry’s term for an agent holding more access than its task needs, jumped from sixth to third in OWASP’s 2026 ranking of AI application risks. Buyers are paying up too: Cyera acquired agent identity startup Oasis for $1B last month, and earlier this year Cisco bought Astrix, Fortinet bought Virtue AI and F5 bought CalypsoAI. A new crop of startups is attracting serious funding to tackle the problem, and CB Insights recently mapped them against the risks Anthropic itself warns about. It’s a useful frame, and I’ll come back to it below. But first, the company that best captures this moment happens to be Israeli.

Israel’s front-row seat: Irregular

Irregular, formerly Pattern Labs, was founded in Tel Aviv in 2023 by Dan Lahav and Omer Nevo. It builds cyber test ranges where frontier labs push their models into extreme scenarios to measure dangerous capabilities before release. OpenAI, Anthropic and Google are customers, as are government organisations.

Here’s the twist: several of this summer’s breakouts happened inside Irregular-hosted evaluation environments. OpenAI pointed to a misconfiguration in the testbed that allowed models to reach the public internet. Irregular says the incidents weren’t evidence of models independently breaking out of a secure sandbox, and that it has since fixed the setup and added safeguards.

You might expect that to hurt the business. Instead, Irregular is reportedly raising more than $100M at a $1.5B valuation, led by Thrive Capital and Greenoaks, roughly three times the reported valuation of its Sequoia-led round last year. Calcalist reports the company has been profitable since 2025.

My read is that investors are pricing in two things. The incidents proved that the capabilities Irregular measures are real, and the labs clearly want independent testers rather than grading their own homework. But there’s a lesson here for every evaluation company: containing the thing you’re testing is now a core product requirement, not a footnote. “How do you contain what you test?” belongs on every diligence checklist in this space.

Irregular is also part of a wider pattern. Israel’s cyber DNA, built around identity, access and runtime protection, maps almost perfectly onto the problem of controlling AI agents. In September alone, AIR Security raised $50M to build a firewall for AI agents and Cymphony raised $25M to secure the overlap between employees and agents. Both Oasis and Astrix have Israeli roots, as do Zenity and Noma Security, two of the companies on CB Insights’ map.

Mapping the category

The easiest way to understand misalignment startups is by the failure mode they address. There are four, plus a fifth layer for when everything else fails, and they sit at very different stages of maturity.

Limiting what agents can do. The most developed segment doesn’t try to fix the model at all. It assumes something will go wrong and limits the blast radius. WitnessAI sets rules for what agents can do and monitors their activity. Zenity finds agents across a company and flags risky behaviour. Noma Security manages agent identities and access, and has grown its team 154% in a year to around 150 people. Straiker blocks attacks and risky agent behaviour, and E2B runs agent code in isolated sandboxes for customers including Manus, Perplexity and Groq. The Hugging Face breach is practically a case study for this layer: the agents needed exposed credentials and an open network path, and least-privilege controls would have shrunk the damage considerably. This is where the buyers and the exits are today. It’s also crowded, so a new entrant needs a sharp technical wedge, not another dashboard.

Catching agents that game the test. Models can behave differently when they know they’re being watched, which quietly undermines every evaluation. Patronus AI tests agents in realistic environments before launch, Mindgard automates red teaming, Gray Swan combines red teaming with post-deployment monitoring, and Raindrop watches live agents for unexpected behaviour. Since the Hugging Face incident was, at its core, a test-gaming incident, I’d argue this category just became more urgent. It’s turning into a real market, though frontier evaluation still depends on a small number of very large buyers.

Finding capabilities nobody looked for. How do you discover an ability you weren’t testing for? That’s the domain of interpretability and model auditing. Goodfire builds tools to analyse and edit what happens inside models and counts Mayo Clinic as a client. Martian, Guide Labs and Tilde Research each approach the inner workings of models from a different angle, and Irregular tests frontier models for unexpected cyber capabilities. This segment is much earlier. A lot of the work happens inside the labs and is effectively given away, so venture-scale outcomes probably depend on regulation or enterprise audit requirements creating a buyer outside them.

Detecting manipulation. The thinnest category covers models that mislead, flatter or steer the people overseeing them. Alice tests whether models deceive their overseers while secretly pursuing another goal, and Apollo Research evaluates frontier models for strategic deception. Much of the serious work here sits at nonprofits. Fewer startups could signal whitespace, or simply that nobody is buying yet. I’d want to see a paying customer before forming a thesis.

Paying for it when prevention fails. Armilla AI already sells AI liability insurance, and with OpenAI now facing a lawsuit over Hugging Face, that market just became a lot less theoretical. Incident forensics belongs here too. Hugging Face reconstructed more than 17,000 attacker actions, largely using AI tools of its own.

Why self-improving agents raise the stakes

There’s a second trend that makes all of this more pressing. A wave of research is teaching agents to improve themselves. Microsoft’s SkillOpt and Google’s WikiSkill let agents rewrite their own instructions based on what worked and what didn’t. Self-Harness and the Darwin Gödel Machine go further, letting agents modify their own prompts, tools, memory and control flow, and Meta’s Hyperagents even let the improvement process itself evolve. Xiaomi’s HarnessX co-evolves the agent and the underlying open-weight model, while EnvHarness and EverMind’s Raven extend the same idea to training environments and multi-agent coordination.

The loop is the same everywhere: run tasks, study the traces, change part of the system, and keep the change if the score goes up. It’s a genuine productivity unlock, and it changes the misalignment picture in a few important ways.

First, guardrails can no longer live inside the agent. If an agent can rewrite its own prompts and tools, any safety rule written there becomes a suggestion. Controls have to sit outside the loop, enforced at the level of identity, permissions, sandboxing and network access, which strengthens the case for the control layer.

Second, these optimisation loops are Goodhart machines. Every framework accepts a change when a validation score improves, and the Hugging Face agents were optimising for a score too. Self-improvement scales the incentive to game tests, which makes tamper-resistant, realistic evaluation a safety mechanism in its own right.

Third, point-in-time audits lose their meaning. The agent you certified on Monday isn’t the agent running on Friday. That favours continuous monitoring over one-off certification, and it hints at a category that barely exists today: change governance for agents, tracking what changed, why, and who or what approved it.

The research I drew on ends with a line I like: developers will spend less time hand-tuning agents and more time deciding what can change, what must stay fixed and how improvement is measured. That’s a pretty good description of the job this whole category is trying to do.

Where I’m looking

As a pre-seed investor, I’m most interested in the gaps the incidents exposed rather than the segments that already have incumbents. Evaluation containment and integrity looks under-built relative to demand, and Irregular shows both the appetite and the cost of getting it wrong. Continuous monitoring and change governance for self-modifying agents is barely a category yet, but it will be needed as these research frameworks move into production. I’m still open to the control layer, but only for teams with a genuinely new technical wedge, such as short-lived, per-task credentials or egress control for agent sandboxes. Forensics and liability now have real demand. Manipulation I’m watching, waiting for a buyer to show up.

For founders already shipping agents, including in our own portfolio, the practical takeaways are simple. Audit where your agents hold standing credentials, scope access to each task, log every action, and treat any self-optimisation loop like a code change that needs review. Enterprise buyers will start asking about all of this, if they aren’t already.

The brakes are becoming a business. And given how many of the companies building them come out of Israel’s security ecosystem, I expect a good number of the winners to have Tel Aviv on their cap table.

The original version of this newsletter was emailed to 8,400 people on Linkedin.

Firgun (pronounced ‘feer-goon’) is an Israeli term describing genuine, unselfish joy in someone else’s success… It’s basically the opposite of “schadenfreude”. Every week since March 2020, we celebrate the wins of our startup community. Read more about why Firgun matters. If this was forwarded to you and you’d like to subscribe, previous editions are on VC Cafe.

This week, the strongest example of firgun came from outside tech. On Wednesday, September 30, Flydubai flight FZ1073 from Dubai to Tel Aviv diverted to Saudi Arabia after an attack in the cockpit that Israeli officials described as an attempted hijacking and terror attack. According to reporting, the injured Indian captain, Smit Machchhar, fought back and opened the cockpit door, allowing Israeli passengers to help overpower the attacker. Yaniv Hayoun helped intervene at the controls, Dr. Shota Musaev treated the wounded captain, and additional pilots aboard took over and landed safely in Tabuk. A huge kol hakavod to the captain, crew and passengers whose courage helped avert a catastrophe, and wishing the injured captain a full recovery. As we approach the third anniversary of October 7, there is much to remember, and much to be grateful for in the people who step forward to protect others.

Israeli startups raised $13.2 billion in the first 9 months of 2026. Given the current pace of investments, the total amount for the year is likely to surpass the $15.6 billion invested in 2025. The headline is encouraging, but the concentration matters: mega rounds in a small number of startups does not automatically translate into an easier fundraising environment for everyone else.

In the wider tech world, It was a heavy week at the frontier. Google unveiled Gemini 4 Argon on Sept 30, topping a third-party model index and claiming it can autonomously find and patch vulnerabilities, though access is limited for now to cyber partners through its Fairwind program, while OpenAI used DevDay to launch always-on “Dots” agents with their own cloud computers, a cheaper GPT-6.1 Sol and a $500/month Pro tier, even as it reportedly shelved GPT-6.1 Astra over safety concerns, drew fire over agents that scraped 55 government and corporate sites, and was reported to be seeking at least $30B at a $1.4T valuation as its IPO slips to 2027. Anthropic had a big week on the capital side: a confidential draft IPO prospectus reported by Reuters points to a $2T+ valuation target and up to $100B raised, alongside news that Broadcom will lend up to $42B to finance its TPU compute. @Microsoft rolled out its Copilot “super app” with Home, Code and Autopilot, built mainly on Anthropic and OpenAI models, and Meta set up a new Enterprise AI Platform unit under former MongoDB CEO CJ Desai. NVIDIA and partners also pushed an Open Agent Safety Platform to stop rogue agents, with Anthropic publicly on board. In China, DeepSeek open-sourced an MIT-licensed agent framework plus tooling for Huawei Ascend chips, ByteDance was reported to control about a fifth of China’s operating data-centre capacity, and the Moonshot distillation story (16,000 requests aimed at OpenAI’s reasoning traces) kept the US-China model race in the headlines. On the money side, AMD agreed to buy Fei-Fei Li’s World Labs for $8.2B in stock (she becomes AMD chief scientist), Instinct raised $1B at a $10B valuation, General Intuition n raised $220M at $6.2B, EliseAI raised $350M at $4B, Armadin (Kevin Mandia’s autonomous red-team startup) raised $255.5M at $2.5B+, ElevenLabs hit $22B in a $300M employee tender, and Kalshi is reportedly closing in on $1B at a $40B valuation.

Happy Simchat Torah to everyone celebrating. 3 years ago was perhaps the darkest day in Israel’s history, and I truly hope we can only learn, heal and improve from the painful memories of October seven.

QUOTE OF THE WEEK

“Power works by division, influence by multiplication. Power, in other words, is a zero-sum game: the more you share, the less you have. Influence is a non-zero-sum game: the more you share, the more you have.”

Jonathan Sacks, Lessons in Leadership

NEW FUNDING ROUNDS

• Huge congratulations to Ofer Klein and the Reco team on announcing $55 million in additional funding to help enterprises manage the risks of putting agents to work!
• Mazal tov to Nir Yaron and team HyperGuest t on raising $25 million to connect hotels with travel companies, technology providers and AI agents, processing over $1 billion in transactions!
• Kudos to Mickey Haslavsky and team enso team on a $15 million Series A to help businesses automate growth with AI agents!
• Kol hakavod to Guy Kozliner and team Rig Security on emerging from stealth with a $12 million seed round to distinguish agents’ actions from those of the humans whose identities they use, and enforce security policies at runtime!

EXITS

• Way to go Guy Bortnikov, Lior Gorbonos and the Inferize team on their acquisition by Nebius for an estimated $115 million, only 10 months after founding and while still in stealth!
• Firgun to Eyal Lifshitz and the Bluevine team on agreeing to join Valley Bank in a transaction valued at approximately $340 million to offer their digital banking platform serving approximately 175,000 active small-business customers!

APPOINTMENTS

• A special firgun to Noa Argamani on joining Vine Ventures. After surviving 246 days in Hamas captivity, she is beginning a new chapter supporting Israeli entrepreneurs and helping them connect with opportunities in the US. Wishing her every success.
• Kudos Motti Hadas for joining OpenAI as the GTM lead for Israel!

NEW FUNDS

• Well done Lital Leshem, Lee Moser and the Protego Ventures team on the final close of your $125 million first fund focused on Israeli defence-tech !

LINKS FOR YOUR BROWSER

VC CAFE/ REMAGINE VENTURES/ ISRAEL VC

• What it takes to raise a pre-seed, seed and Series A in 2026. My latest post brings together round benchmarks and the evidence investors look for at each stage. The practical question: what will this round allow you to prove before you need to raise again?
• Your customers don’t care which AI model you use. Better models can improve everyone’s product at once. I explore how distribution, workflow expertise and customer relationships can turn that shared technical progress into an advantage for your company.
• There are 1,781 Israeli founders in stealth – what do they have in common? My latest Israel VC infographic

ISRAEL

• Unprecedented: Extraordinary heroism and near-miraculous circumstances avert an airplane catastrophe – There appears to be no prior instance of passengers thwarting a pilot’s attempt to crash a commercial airliner
• $13.2 billion in nine months: Inside Israel’s AI-fueled funding surge – Three quarters of funding data suggest 2026 will comfortably exceed 2025’s total of $15.6 billion.
• Why it’s easier to build but harder to raise, and why learning speed now matters more to early-stage investors. Investor commentary, not data.

GLOBAL

• 100 charts on the state of markets by Andreessen Horowitz
• Check out this video of AI agents doing full video calls – by Tavus
• all the ways AI can destroy humanity – don’t read this before bed

MEDIA OF THE WEEK

Who are the previous employers of US unicorn founders? Ilya Strebulaev found that the IDF is one of the things 62 of them had in common in “the making of a unicorn founder“

Startups solving for when AI goes rogue – it turns out that there are several Israeli startups operating in this category: Zenity, Irregular, Noma Security… (chart by CB Insights)

What it takes to raise pre-seed, seed and series A in 2026 from my VC Cafe post on fundraising benchmarks (source)

Israeli founders in stealth infographic created by me for Israel VC (source)

AI Native services market map by Kadan Capital (source)

AI is changing how expertise gets built. As routine tasks are increasingly supported by AI, judgment, creativity, and resilience become more important, making coaching and real-world experience critical parts of how organizations develop talent. Source: McKinsey & Company

The AI40 recognizes the top private companies shaping the future of applied AI, from foundational infrastructure to full-stack intelligent applications – by Madrona

Another reason it will be hard to slow down AI development: AI must earn $6Trillion a year by 2031 to pay for its buildout

Now there’s been a happy ending, we can enjoy some comic relief about the FlyDubai hijacking. Here are some of my favourite memes:

Statistically he’s right…

Translation: “Netflix should get a subscription to Israel”

I’m happy to hear that the organisers took care of this swiftly. The event was de-listed and organiser removed. There’s no place for antisemitism in tech #SFTECHWEEK (source)

That’s all for this week, thank you for reading. There’s a lot to celebrate in our “small” community! Keep on creating.

Eze Vidra

At pre-seed the pattern is even sharper. U.S. startups on Carta raised $3.19 billion across roughly 11,500 SAFEs and notes in Q2 2026, against $3.22 billion across 14,825 instruments a year earlier: similar money, about a fifth fewer deals. The average pre-seed instrument reached a record $276,000. (Carta, State of Pre-Seed Q2 2026)

Pricing tells a split story. Median seed and Series A valuations are up year on year, but the medians blend two very different markets. In Q1 2026, an AI foundational-model company raising a Series A was priced at around a $300 million median valuation, against roughly $55 million for a non-AI startup. And every one of these medians describes companies that closed. They say much less about the founders still searching for a lead investor.

So the useful question is not how much companies are raising, but how to become fundable at the next stage: what evidence investors expect, how much ownership the round might cost, and whether the cash will last long enough to deliver the next milestone.

The benchmarks at a glance

U.S. Carta data, Q2 2026, the latest quarter Carta has published. Israel figure from Fusion’s 2025 pre-seed report. Full caveats in the data note at the end.

A quick note before going further: these figures come mostly from U.S.-headquartered Carta customers, and Q3 2026 data has not yet been published (Carta typically releases quarterly figures several weeks after quarter end). They are reference points for Israeli and European founders, not local market averages.

I have explored related questions in 2023–2024 B2B SaaS Benchmarks and Startup Benchmarks, originally published in 2019. Those posts cover choosing metrics for different business models; the financing figures here use the most recent sources available.

I put together the IsraelVC infographic below using Carta’s U.S. startup data and fundraising research from Dropbox DocSend. Here is how I would read it as a founder, and what I think it means for early-stage investors.

Pre-seed: revenue can wait; evidence cannot

At pre-seed, investors can back a company before it has revenue. The founder still needs to reduce uncertainty: is the problem important, does the team understand it, and is there a credible starting point for a product?

Useful evidence might include a prototype, thoughtful customer discovery, design partners or early product usage. These signals carry different weight. A customer saying an idea sounds interesting is a weaker signal than a customer committing time, data or money to test it.

In B2B, I pay particular attention to whether a design partner has a real problem, an identifiable budget owner and a reason to adopt the product. For consumer or gaming startups, usage and retention may matter more than any ARR target.

The financing structure is now close to standardised. In Q2 2026, 93% of pre-seed rounds on Carta used SAFEs (95% by capital), and 91% of those SAFEs were post-money. The median post-money cap for raises in the $500K–$999K band was $12.5 million, while SAFEs above $2.5 million carried a $35 million median cap, up 40% year on year. (Carta’s SAFE analysis) Much of that top end is AI: AI companies took 49% of all pre-seed dollars in H1 2026.

Israeli founders should expect a different picture. Fusion’s Israeli Pre-Seed Report covering 2025, published in March 2026 and drawing on 70 Israeli investors and nearly 1,200 teams, reports a $6.8 million median post-money valuation cap and a $7.25 million average. It is the most recent local dataset available. The sample and period differ from Carta’s, so the two shouldn’t be used to calculate a precise geographic discount. But the direction is clear, and I discussed the local findings in more detail in The State of Israeli Pre-Seed in 2025.

A SAFE cap is a conversion term, not a priced valuation. Founders should model the cumulative ownership impact of every instrument they issue, especially when stacking several SAFEs before the first priced round.

My practical advice: make the pre-seed plan specific enough that an investor can see what the money will establish. Which uncertainty will you remove, and what evidence will make the company attractive to a seed investor?

Seed: higher valuations still cost meaningful ownership

Carta’s Q2 2026 benchmarks put the median seed round at $4.5 million on a $23.9 million post-money valuation, with 19.4% median dilution. (Carta, Q2 2026 round benchmarks)

These are separately calculated medians, so dividing round size by valuation won’t reproduce median dilution. The practical implication is still clear: a successful seed round can mean selling around a fifth of the company. Carta’s Founder Ownership Report 2026 finds founding teams hold about 56% of equity after seed and roughly 36% after Series A.

The median also hides a wide spread. In Q1 2026, the 90th percentile seed valuation was nearly 4x the median. Top-decile pricing is not a reasonable anchor for most companies.

In my experience, seed in B2B is less about one fixed ARR number and more about validating paying, recurring customers. I want to understand who pays, what they use, whether they come back, and whether the next customer can be won for reasons beyond the founder’s personal network.

A seed plan should start answering those questions. Product, hiring and sales spend should connect to evidence that the company can eventually support a Series A. A larger round buys more resources, but it also raises the bar for the next financing.

Series A: revenue quality and speed become harder to separate

The median Series A in Q2 2026 raised $14.7 million on a $76.3 million post-money valuation, with 18.7% median dilution. SaaS companies sat higher, at a $93.5 million median post-money. (Carta, Q2 2026 round benchmarks)

As at seed, the headline blends very different markets. Top-decile Series A valuations were nearly 5x the median in Q1 2026, and the AI foundational-model premium described above sits almost entirely in that tail. If you are not in that category, benchmark against companies like yours.

The proof required gets more demanding. Investors want to know whether growth is repeatable, customers stay, economics improve with scale, and the team can execute beyond a few early wins.

From my own experience, for B2B recurring-revenue companies, the Series A conversation increasingly starts around $3.5 million–$5 million in ARR, ideally reached quickly. That is a market observation, not a Carta median or a universal threshold.

Even within software, two companies at $4 million ARR can present very different cases. Strong retention, diversified customers and repeatable acquisition tell an investor something very different from dependence on a single customer, bespoke services or expensive one-off contracts.

For AI companies, I also look closely at gross margins, delivery costs and the durability of demand. Fast adoption is encouraging; the case gets stronger when the company can explain how that adoption becomes a sustainable business.

Two recent reports help calibrate comparables:

• Broad private SaaS: SaaS Capital’s 2026 growth benchmarks, covering more than 1,000 private B2B SaaS companies, report 22% median growth in 2025 (25% for equity-backed companies), and a strong link between net revenue retention and growth. Useful operating context, not a target for a young venture-backed company.
• The outliers: ICONIQ’s September 2026 State of Scaling report finds selected fast-growing, AI-forward companies going from $1 million to $100 million ARR in two to four years, with net retention of 120–146%. They also spend heavily and run lower gross margins than historical software norms.

The lesson for founders and VCs: look at growth, retention and cost of delivery together before choosing a comparable.

Time to close a round and time to reach the next round are different problems

Dropbox DocSend’s 2023–24 research found that successful pre-seed and seed companies closed their rounds in 12 weeks or less, on average. It remains the most detailed public dataset on round duration, but it is a historical success sample, not a promise about every raise in 2026.

For Series A, Carta’s September 2026 guide suggests allowing a few months for the whole process, including 4–8 weeks for legal negotiations and closing after a term sheet. This is planning guidance rather than an observed median.

The bigger operating challenge is reaching the next fundable milestone. In Carta’s most recent published figure, companies raising a Series A in Q2 2025 had waited a median 616 days, a little over 20 months, since their seed round. (Carta, Series A fundraising Q2 2025) That measures the gap between rounds, not 20 months of pitching, and it only counts companies that made it.

Founders often plan a raise around 18–24 months of runway. A 20-month median leaves little room for delayed hiring, slower sales or a longer-than-hoped financing process.

Build a cash plan that includes time to produce convincing results and time to raise against them. Work backwards from the evidence required and model what happens if it takes longer. If an extension becomes necessary, understand its ownership impact, conversion mechanics and any additional rights before treating it as a simple runway top-up.

What this means for VCs

These benchmarks should also make investors look at how they set expectations.

• Match the cheque to the path. If a fund backs a company at seed but expects much stronger revenue and operating proof at Series A, that path should be discussed early. The initial cheque, spending plan and next-round milestones need to fit together. Otherwise a founder can execute the agreed plan and still hit a financing gap.
• Plan reserves for the slow case. With a median gap of around 20 months between seed and Series A, pre-seed and seed investors should size cheques and reserves around the slower scenario, not the base case. Bridges and extensions are part of the portfolio reality, not an exception.
• Watch the Israel-to-U.S. gap. Many Israeli companies raise pre-seed and seed at local pricing, then pitch their Series A to U.S. funds that benchmark against U.S. metrics and U.S. valuations. That transition is where the financing gap above is most likely to appear. Investors in Israeli companies should help founders prepare for the evidence a U.S. Series A lead will expect, well before the raise.
• Be precise about comparables. A SAFE cap, a priced valuation and a bridge are different reference points. A U.S. all-sector median is a starting point, but a weak substitute for understanding the company’s actual market.
• Explain the bar, not just the number. Asking for an ARR figure is easy. Explaining which customer behaviour, growth quality and unit economics would create conviction is far more useful to a founder.

Build the plan around the next proof point

Before starting a raise, I would write down four things:

• The evidence the company can show today.
• The next milestone that should make it meaningfully more fundable.
• The money and time required to reach it, including a slower-case scenario.
• The ownership implications of the proposed financing and a possible extension.

Benchmarks help you decide where to aim. The operating plan needs to explain how you will get there.

Founders: are these benchmarks consistent with what you are seeing? And for VCs, where has the bar moved most: traction, growth quality, valuation or the time needed to build conviction?

Data note: Round benchmarks are Carta Q2 2026 figures, the most recent quarter published as of 1 October 2026; Q3 2026 data has not yet been released. AI vs non-AI valuations and percentile spreads are from Carta’s Q1 2026 reporting. The seed-to-Series A interval is Carta’s most recent published figure (Q2 2025). Carta’s Round Benchmarking Tool covers U.S.-headquartered companies on its platform and excludes bridge rounds and convertible instruments, so pre-seed figures come from Carta’s separate SAFE reports. Carta customers are not a representative sample of all startups, and recent quarters are typically revised upward as transactions are recorded. There is no uniform discount to apply to U.S. figures for Israeli or European companies: sector, traction, investor competition and the market you are raising in all matter. ARR expectations are explicitly identified as personal observations.

AT&T processes 45 billion AI tokens a day. About 40% of its AI workloads already run on open models, and it wants that figure to reach 70% within a year. Its calculation is straightforward: maintain accuracy while reducing the cost of delivering it.

At Tinder, the pressure is equally tangible. Its chief technology officer told the Financial Times that AI spending had climbed from an annualised rate of $1 million in January to $10 million by July. The company has started routing some queries to open-weight models to help control those costs.

Customers care about model choice when it affects their results, their data or their bill. But those requirements do not explain why they will choose your product over another built on the same technology. If your competitors can make the same upgrade, everyone’s product may improve without your competitive position changing.

This is where I think founders should spend more time on distribution: a repeatable way to reach the right customers and convert their interest into adoption at workable economics. Product value determines whether they stay; strong retention and referrals can then make distribution more effective.

For many AI application companies, the more durable advantage will sit in the customer relationships, workflow expertise and routes to market they build around the technology. Founders should give those questions the same rigour they bring to model selection.

What are you actually underwriting?

When I assess an early-stage investment, I want to understand what becomes more valuable as the company grows. That might be a workflow that becomes harder to replace, customer relationships that generate referrals, proprietary data that improves the product, or a route to market that competitors would struggle to reproduce. Access to a commercially available model can help create those assets, but is rarely an exclusive advantage itself.

A better product and a stronger competitive position are related, but they are not interchangeable. A company can keep improving its product while finding it harder to acquire customers or defend its pricing. The technical roadmap should therefore connect to commercial outcomes. Making an unreliable workflow usable is significant. Improving a benchmark without changing customer behaviour may deserve less urgency than fixing onboarding or establishing a working sales channel.

Distribution changes the economics of a good product

Microsoft can introduce Copilot inside applications its customers already use. Meta’s Muse brings the same distribution question into consumer AI, with the additional pressure of a free base tier.

According to PitchBook, citing Apptopia data, Muse reached number one on the iOS App Store in less than two weeks. The personal AI assistant space is heating up right now, it’s a great example of how distribution is going to determine the winner.

Instinct is a serious competitor to Muse with deep pockets and distribution via Whatsapp. But a large round does not give a startup the same economics as a platform that can promote an assistant through WhatsApp and Instagram while subsidising the compute required to operate it. Instinct and all the other competitors in this category must finance development, acquire users and establish a business model while Meta’s Muse offers an overlapping service for free and literally owns the platforms.

The download figures establish reach, not retention or a settled winner. Trust also matters when an assistant asks for access to messages, payments and sensitive information. I would be careful about concluding that consumer AI is therefore closed to startups.

The requirement is more specific: a horizontal assistant needs a compelling explanation of why customers will seek it out, keep using it and pay for it when a free alternative is being put in front of them. A particular audience, a substantially better workflow or a trusted community can provide an opening. The founder then has to demonstrate that this advantage translates into adoption and workable acquisition economics.

Start with a market you can reach

A large addressable market tells me something about the potential ceiling. It tells me much less about how a company will get started.

“Every small business could use this” leaves almost every important distribution question unanswered. Which businesses have the most urgent problem? Who controls the budget? Where do those buyers look for advice? What would make them take a meeting with an unknown startup?

A more specific starting point creates something founders can test. An operations product for a particular type of wholesaler might reach buyers through industry groups, software implementers or trusted advisers. That does not establish demand, but it creates a plausible route to discovering it. A precise explanation of how to reach an initial market, with a credible path to expand, is more useful than a broad market definition with no acquisition insight.

Early founder-led sales are valuable here. Doing the work manually reveals objections, budget processes and the language customers use to describe the problem. The aim is to turn those lessons into a process someone else can eventually repeat. If every sale depends on a unique personal favour, there is still work to do.

It’s difficult to get the balance right between “we’re targeting a huge market” to “we have a very specific ICP”, but I’d much rather have a clear path to the first million in revenue by being very specific about who’s problem the product is solving, than be comforted by the notion that the market is big.

Build distribution into the product

Some distribution mechanisms emerge from how a product is used. A collaborative workflow brings in colleagues. An output shared with a client introduces another potential customer. A partner embeds the product in a service it already sells. Dropbox’s referral programme, which rewards both parties with additional storage, connects the incentive directly to the product’s value.

For an AI company, the useful question is whether delivering value can naturally create the next introduction. A research product whose findings circulate within a company may have that potential. A private, single-user utility may need an entirely different acquisition strategy.

The mechanism needs evidence. A share button is a feature; the proportion of recipients who become active users tells you whether it contributes to distribution. A partner agreement creates an opportunity; activated, paying customers show whether the channel works.

Founders also need to understand how much control they have. Dependence on one marketplace, advertising platform or partner can leave acquisition exposed to someone else’s pricing and priorities. A successful channel becomes more valuable when it helps build direct customer relationships.

Measure the constraint before allocating more runway

At pre-seed and seed, these choices are capital allocation decisions. Being data-driven means using the evidence available to identify what is holding the business back, while recognising the limits of a small sample.

If prospects abandon the product because results are unreliable, model performance may be the priority. If customers retain and expand but few qualified buyers enter the funnel, distribution deserves more attention. If deals stall during implementation, another marketing campaign may simply create a larger backlog. The next week of engineering or sales effort should address the constraint the evidence reveals.

What I want founders to bring into the room

I do not expect a pre-seed company to have a proven acquisition engine. I do expect a thoughtful view of how it could build one, what the founders have learned and which evidence would cause them to change direction. Ultimately, it’s our joint goal to understand how can the startup scale.

The founders I want to work with can explain why their architecture matters and what they learned from a customer who declined to buy. They bring curiosity and discipline to both. Before the next model switch, ask: if we already had the best model for this task, what would still stop this company from growing? The answer deserves a place on the roadmap.

The original version of this newsletter was published on Linkedin to 8,400+ subscribers.

Firgun (pronounced “feer-goon”) is the Hebrew word for taking genuine pleasure in someone else’s success. Every week since March 2020, we’ve made time to celebrate the people building, creating and moving our startup community forward. If this was forwarded to you, you can find previous editions on VC Cafe.

With Sukkot beginning this evening, it’s a fitting week to think about the things we build and the people we invite in. Startups depend on much more than their founders: early employees, customers willing to take a chance, investors, mentors, employees and friends who make an introduction when it matters. Firgun is a small way of recognising that collective effort. Chag sameach to everyone celebrating, and wishing our community health, peace and more reasons for optimism.

Preliminary IVC–LeumiTech figures put Israeli tech funding at $3.6 billion across 91 rounds in Q3, up 53% year on year, and $11 billion year to date. Capital remains concentrated in a relatively small number of companies. As an early-stage investor, I see the challenge as turning that confidence in established winners into opportunities for the next generation.

In the wider tech world, it was a loaded week in AI. OpenAI shipped GPT-6 Sol and GPT-6 Luna, extending its latest model family into more affordable tiers, while Anthropic launched Claude Opus 5.5, claiming performance comparable to Fable 5.1 on most work at around 40% lower running costs than Opus 5. Google made Gemini 3.8 Live with Live Avatar generally available and outlined private, persistent memory for AI assistants. Anthropic also introduced its life-sciences research group and physical laboratory, reporting that Claude helped identify a previously uncharacterised enzyme system with CRISPR-like features. Its function is still being investigated, and human scientists perform the physical experiments. Meta used Connect 2026 to push personal AI into new devices: Ray-Ban Meta Audio glasses, the pocket-sized Muse Charm, and plans to bring Muse to its AI glasses, alongside new shopping and productivity connectors. It also announced 100-gram Meta VR Glasses priced at $1,299.99, due in spring 2027. In China, Alibaba Group unveiled its Zhenwu V900 AI chip and outlined plans for models with 5–10 trillion parameters, alongside a target of more than 20GW of cloud data-centre capacity by 2032. Meanwhile, @DeepSeek and Kimi (Moonshot AI) reportedly face a Chinese regulatory investigation into possible data transfers to Anthropic’s Claude, adding another trust and sovereignty question to the AI race. Bessemer Venture Partners announced $5.75 billion in new capital, with AI a major focus; Hubble Network raised a $200 million Series C at a $1.6 billion valuation for satellite connectivity using Bluetooth devices; and European AI cloud provider Verda announced $189 million in financing and unicorn status. Snorkel AI also raised $350 million at a $3.5 billion valuation as demand for specialised AI training data grows. And Andreessen Horowitz introduced the Horowitz Andreessen Academy, a school for young builders.

QUOTE OF THE WEEK

“If you have built castles in the air, your work need not be lost; that is where they should be. Now put the foundations under them.”

Henry David Thoreau

NEW FUNDING ROUNDS

• Huge congratulations to Dan Amiga, Michael Fey and the Island team on raising a $400 million Series F at a $6.4 billion valuation to expand enterprise security controls for employees and AI agents!
• Mazal tov to Yotam Segev, Tamar Bar-Ilan and the Cyera team on securing a $400 million Series G extension bringing its 2026 fundraising to $1.4 billion, to help enterprises protect sensitive data and govern access by AI agents!
• Kudos to Alex Zilberman and the Chamelio team on raising a $26 million Series A, led to automate contract review and workflows for in-house legal teams!
• Kol hakavod to Davidi Vortman and the UltraSight team on raising a $24 million Series B2 to expand AI-guided cardiac ultrasound workflows across US healthcare systems!
• Congrats Ronen Korman and team Prime Minute on coming out of stealth with a $15M pre-seed funding round to develop precision-guided aerial tech for natural disaster and wildfire response!

EXITS

• Way to go Nadav Orbach and team RealSense on the acquisition by Cognex Corporation for $600M to power computer vision for machines!
• Big congratulations to Omri Limor Saar Ankonina and the Aegis team on joining Upwind Security just nine months after founding the company for a deal worth tens of millions of dollars.
• Well done to Shon Lev-Ran ? , Shir Monether and the Wand Cloud (Acquired by groundcover) team on their acquisition by groundcover! The deal brings automated Kubernetes resource optimisation into groundcover’s monitoring platform. Terms were not disclosed but estimated to be in the tens of millions of dollars.
• Firgun to Itay Nourian and team Insignito Solutions Ltd, Amit Rosenzweig and team Ottopia Defense and CaribouLabs team on getting acquired by Ondas Inc. with $56 million in initial consideration (for all three company) and up to $32 million in additional performance-linked payments! The businesses add drone detection, remote operation, communications and navigation capabilities.

NEW FUNDS

• Firgun to Adam Fisher, Amit Karp and the Bessemer Venture Partners Israel team on raising $5.75 billion, allocating $1.75 billion to seed and early-stage investing and $4 billion to growth, with AI a major focus!
• Mazal tov to Osnat Velingard and the Ibex Investors team on raising $87 million for their second Israel-focused secondary fund, providing liquidity to founders, employees and early investors in growth-stage Israeli companies!

LINKS FOR YOUR BROWSER

VC CAFE/ REMAGINE VENTURES/ ISRAEL VC

• AI neo-labs have raised $11.6 billion. What have they shipped? My latest VC Cafe post looks at the capital requirements of frontier AI research and compares public evidence of progress across ten labs. The $11.6 billion counts selected disclosed rounds, rather than cumulative funding. The question for investors is what milestones justify the next round when normal product-market fit signals may still be years away.
• Jev and the missing decision layer for AI Much of what software needs from AI is a choice, a score or a decision. I explore TypeSafe AI’s approach and what it could mean for classification, routing and the economics of agentic applications.
• AI – how worried should we really be? I was quoted by the Jewish News on the warnings about AI’s potential risks and wether development of frontier models will slow down (spoiler alert: it won’t).

ISRAEL

• Israeli tech funding grows, but the recovery remains concentrated. The preliminary IVC–LeumiTech review puts cybersecurity at about 38% of year-to-date funding and enterprise software at nearly 30%. A useful reminder to look beyond the headline total when assessing how accessible capital is to founders.
• Nvidia launches Israel AI lab to develop drugs and drive medical breakthroughs – New team under CTO Michael Kagan will recruit dozens of researchers and work with Sheba, Mount Sinai and global partners on genomics, drug discovery and advanced materials
• A new route for private capital into defense technology. The Adir and Sling programme uses government guarantees to encourage investment in strategically important technologies, including areas that have struggled to attract conventional venture funding.

GLOBAL

• Jumbo Series A rounds are on the rise – by Crunchbase
• The SaaSpocalypse was more like a RenaiSaaS – by Stripe
• VC Quantitative Perspectives: Is Venture’s Odyssey Epic or Myth? by PitchBook

MEDIA OF THE WEEK

Israeli tech companies raised $3.6 billion in 91 disclosed funding rounds in Q3/2026, according to preliminary data from IVC Data and Insights and LeumiTech‘s Tech Review. The quarterly total was 7% below the H1/2026 quarterly average but 53% higher than in Q3/2025. Cyber continued to lead, with $4.3 billion raised since the beginning of the year, accounting for 38% of total capital. Enterprise software accounted for close to 30% of total funding since the beginning of the year, its highest share since 2020.

Agents might consume 99% of AI tokens as soon as next year… by OpenRouter

Ok, this took me a second to digest: SpaceX, Anthropic and OpenAI S are valued together at roughly $5.2 trillion – more than the combined value on their first day of trading of all 3,365 (!) tech companies that went public in the US between 1980 and 2025.

This is an interesting graph on AI adoption US vs. EU… data according to Vercel (source)

AI model market map by Radical Ventures (source)

Neo labs have raised over $11.6 billion in funding, but what have they shipped? from my latest post on VC Cafe (source)

Now that the roadblocks have been removed for the merger between Paramount and Warner Bros. Discovery, they are about to become the largest media company in the world, but not necessarily in attention (by Owl & Co)

The structure of an email that helps founders raise capital from VCs. For inspiration…

That’s all for this week. There’s a lot to celebrate in our “small” community! Keep on creating!

Wishing you a peaceful weekend and a joyful Sukkot. Make time to recognise someone else’s progress, share a useful introduction or help a founder take their next step.

The newest AI labs are breaking the usual venture capital sequence.

They are not raising a seed round to build a product, prove demand and return for a Series A. Some are raising hundreds of millions, or even more than $1 billion, before launching a public product. In several cases, investors are backing a team, a research thesis and the possibility of a breakthrough that may take years to validate.

This new category is sometimes described as the AI neo-lab: a frontier research company founded by prominent alumni of OpenAI, Google DeepMind, Meta and other leading labs, built outside the established hyperscalers and financed at unprecedented scale from inception.

Across ten of the most prominent examples, their latest disclosed mega-rounds total approximately $11.6 billion. That figure counts the selected round shown for each company, rather than cumulative funding, and excludes rounds that remain under discussion.

The more interesting question is not how much they have raised. It is what they have produced so far.

Why AI labs need so much capital

It is easy to understand why a frontier AI lab needs significant capital from day one. Almost every part of its operation is expensive.

First, there is data. Labs may need to acquire or license specialist datasets, generate synthetic data, clean and structure raw information, pay expert annotators and build evaluation environments. The bottleneck is increasingly not the volume of data, but access to data that is proprietary, high quality or connected to the real world.

Second, there is talent. Elite AI researchers and infrastructure engineers command extraordinary compensation. A new lab is competing with OpenAI, Anthropic, Google DeepMind, Meta and a growing number of well-funded startups for a very small pool of people who have trained frontier systems before.

Third, there is compute. Training a frontier model requires sustained access to GPUs, networking, storage and power. Better architectures, more efficient training and stronger data can reduce the amount of brute-force compute required, but they do not make infrastructure cheap. NVIDIA is both a supplier and, increasingly, a strategic investor and partner to many of these labs.

The fourth cost is time. Fundamental research does not fit neatly into an 18-month venture milestone. A company can spend hundreds of millions of dollars recruiting a team, building infrastructure and running experiments before outsiders can reliably determine whether its core technical thesis works.

That creates a difficult funding dynamic. Many neo-labs will need to raise again before they have meaningful revenue, and sometimes before they have released a public product. Each successive round must therefore be supported by research milestones, talent acquisition, infrastructure commitments and investor belief rather than conventional commercial traction.

The AI neo-lab scoreboard

The table below reflects publicly disclosed information as of 23 September 2026. “Public output” distinguishes a usable model or product from a research preview, technical article, partnership or mission statement.

Two labs have already crossed the product line

Thinking Machines Lab and World Labs stand apart because outsiders can use what they have built.

Thinking Machines first released Tinker, an API that lets researchers train and fine-tune models without managing the underlying GPU infrastructure. It then released Inkling, an open-weight, general-purpose multimodal model with 975 billion total parameters and 41 billion active parameters. The company has also released Inkling-Small and published research on interaction models, reinforcement learning and model customisation.

This matters because Thinking Machines is no longer only a bet on Mira Murati and an exceptional team. Investors, developers and researchers can evaluate its model, product strategy and technical choices.

World Labs has followed a different path. Its first product, Marble, generates persistent, explorable 3D worlds from text, images and video. The company subsequently released the World API, allowing developers to integrate those capabilities into applications. It has also published research previews and tools around real-time world generation, Gaussian splatting and robot simulation.

World Labs is therefore providing evidence for both sides of its thesis: that spatial intelligence represents a distinct model category, and that it can support useful creative and developer products.

Neither company has proved that it can generate a return commensurate with its financing. But both have moved beyond asking investors to value a research ambition in isolation.

Research progress is not the same as a product

Recursive Superintelligence sits in the middle of the spectrum. It has not released a broad public model, but it has published measurable results from its automated AI research system. According to the company, the system achieved state-of-the-art results across fixed-budget language-model training, small-model training speed and GPU-kernel optimisation.

That is more substantive than a mission statement, but it is still early evidence. Benchmarks selected and reported by the company are not the same as sustained autonomous research, independent replication or a product that customers will pay to use.

humans& has published technical research but no public model. Periodic Labs has explained how it intends to connect models to autonomous physical laboratories, an approach designed to generate proprietary experimental data rather than relying only on scientific literature or simulations. Both may be making meaningful internal progress. From the outside, however, the evidence remains limited.

This distinction matters because “released something” can mean very different things. A paper, benchmark, demo, API, downloadable model and commercially deployed product should not be treated as equivalent milestones.

The most highly valued promise may be deliberate silence

SSI is the clearest example of a lab whose lack of interim releases is part of the strategy rather than an obvious failure to ship. Its stated roadmap has one product: safe superintelligence. It does not intend to distract itself with conventional product launches along the way.

That alignment may be intellectually coherent. It is also unusually difficult for outsiders to assess. There is no public model, benchmark or research programme against which progress can be measured. The investment case rests heavily on Ilya Sutskever’s record, the quality of the team and the belief that SSI has found a path beyond the prevailing scaling paradigm.

Ineffable Intelligence is pursuing a related but distinct thesis. David Silver has argued that the next frontier is not a system that reproduces existing human knowledge, but one that discovers knowledge through experience. AMI Labs is making a contrarian bet that language models alone will not produce systems capable of understanding and acting in the physical world. Discovery Loop wants AI to become the researcher, automating experimental loops across machine learning, science and engineering.

These are important research directions. At present, however, the public can evaluate the ambition more easily than the execution.

Reflection AI is slightly different. It has announced government deployments, strategic partnerships and enormous compute commitments around a plan to build open frontier models. Yet the central artefact in that strategy, a generally available frontier open-weight model, remains absent. Partnerships can validate demand and provide infrastructure, but they are not a substitute for the model itself.

What should count as progress?

Conventional startup metrics are poorly suited to a pre-product research lab, but that does not mean progress is immeasurable. Investors can look for a sequence of increasingly difficult proofs:

1. Team formation: Can the founders recruit researchers and engineers with direct experience building frontier systems?
2. Infrastructure: Has the company secured enough reliable compute and data access to test its thesis?
3. Research evidence: Has it published reproducible results, credible benchmarks or technical work that advances the field?
4. External access: Can independent researchers, developers or design partners use the system?
5. Repeatability: Does the initial result generalise beyond a carefully selected demonstration?
6. Economics: Can the company turn the research advantage into a product whose value exceeds its extraordinary cost?

Most neo-labs have cleared the first two stages. Only a small number have reached the fourth. None has yet established the sixth at a scale that justifies the valuations being discussed.

The venture model is being rewritten

The neo-lab boom reflects more than enthusiasm for AI. It represents a change in what venture capital is being asked to finance.

Traditional venture investing spreads technical and commercial risk across successive rounds. The neo-lab model front-loads both. Investors commit enough capital to recruit a world-class team and run frontier-scale experiments before the normal feedback loops of product usage, revenue and retention exist.

The attraction is clear. If one of these teams discovers a new model architecture, training paradigm or path to autonomous scientific discovery, the outcome could be enormous. The risk is equally clear. Capital can fund compute and talent, but it cannot guarantee a breakthrough. Nor does technical leadership automatically produce distribution, pricing power or a durable business model.

The next phase will therefore be less about who raised the largest round and more about who can convert capital into verifiable progress. Thinking Machines and World Labs have begun that transition. Recursive has offered an early technical proof. For several others, investors are still underwriting reputation and possibility.