CodeAnt AI

CodeAnt AI operates an agentic security platform that spans both defensive and offensive application security. On the defensive side, the product reviews pull requests line by line with full codebase context, runs a unified AI static analysis pass across source code, infrastructure-as-code, dependencies and secrets, detects cloud misconfigurations across AWS, GCP and Azure, and surfaces issues in the IDE, CLI, PR and CI/CD stages. A Control Center aggregates security and code-health posture across repositories. On the offensive side, the platform maps a customer's public attack surface and runs what the company describes as 500+ exploit agents that chain recon, injection, access-control and business-logic attacks against the running application, plus DAST behind authentication and cloud threat detection.

The stated operating model is to build a single context graph from source, IaC, dependencies, secrets, endpoints, cloud configuration and commit history, derive a threat model of auth boundaries, trust assumptions and data flows, then attack those paths and report only findings that were actually exploited, accompanied by the request, the proving response and reproduction steps. The company frames this as a response to two problems it identifies in the market: SAST and SCA tools producing roughly 10,000 findings of which few matter, and annual human penetration tests leaving organizations without coverage for the rest of the year.

Earlier positioning, as of the 2025 seed announcement, centered on AI code review and code quality: a proprietary, language-agnostic Abstract Syntax Tree engine covering more than 30 languages, integrated with GitHub, GitLab, Bitbucket and Azure DevOps, providing PR summaries, one-click fixes, code-smell/complexity/duplication/dead-code detection, and SAST, SCA, IaC and secret scanning aligned to OWASP and CWE. Prior YC launches also included a developer engineering-metrics product.

Founding story

Amartya Jha and Chinmay Bharti started CodeAnt in June 2023 after experiencing slow and error-prone code review firsthand: Jha previously worked at Zeta and ShareChat, where rushed code changes created operational risk, and Bharti built high-frequency trading systems where a single bug could be costly. The founders describe a formative discovery in which Bharti found a way to forge JWT signatures in a widely shipped library (CVSS 10), a reasoning flaw that pattern-matching scanners had missed for years, motivating a platform that reasons like an attacker rather than matching patterns.

Business model

B2B software sold to engineering and security teams, with self-serve entry (a free pentest requiring no credit card) alongside enterprise sales via demos and scoping calls. The platform is offered as a cloud service and can also be deployed in the customer's own environment / on-premise for security-conscious buyers, with the company stating that customer code does not train models or leave the customer boundary.

Per-developer subscription pricing was reported at the time of the seed round: from $10 per developer per month for basic AI code review up to $40 per developer per month for the full suite including code quality analysis, security monitoring and compliance tooling. For agentic pentesting the company advertises no engagement fee, with payment only if high or critical issues are found and low/medium findings provided free.

Traction

The company reports having run penetration tests for 200+ companies and disclosing 100+ zero-day CVEs affecting packages with 1.85 billion+ monthly downloads, including a CVSS 10.0 authentication bypass in pac4j-jwt (CVE-2026-29000) and a CVSS 9.8 RCE in simple-git (CVE-2026-28292). At the time of the 2025 seed round the company said it scanned over 50 million lines of code, auto-fixed more than 500,000 issues and saved over 100,000 developer hours per day. Team size is listed at 25. Customer quotes come from 11x, Autajon Group and Motorq.

Latest developments

As of 2026 the company has repositioned its homepage around exploit-based agentic security, launched Agentic Pentest (March 2026), disclosed CVE-2026-29000 (pac4j-jwt auth bypass, CVSS 10.0) and CVE-2026-28292 (simple-git RCE, CVSS 9.8), surpassed 100+ disclosed CVEs by May 2026, and cites a Gartner Cool Vendor 2026 recognition in application security along with SOC 2 Type II and HIPAA compliance.