
Developer Advocate @Infisical. Talking all things secrets, PAM, & certificate management. 🎥 YouTuber at Jake's Tech on breaking into tech & dev tools
Houston, TX
Joined January 2026
- Tweets436
- Following74
- Followers315
- Likes730
Jake Hulberg retweeted
Six months in and couldn’t be happier I joined Infisical at such a pivotal time. We’ve got an amazing team, real problems to solve, and a lot more to build.
We’re excited to announce we have raised a $40M Series B!
This next round of funding lets us continue to strengthen our secrets, certificate, and access management products.
We'll also expand the capabilities of Agent Vault, so engineers adopting AI agents can give them access without handing over the underlying credentials.
Thank you to @eladgil, @GradientVC, @ycombinator, and our other investors, as well as our customers, community, and team for helping us get here!
Jake Hulberg retweeted
Congrats to @matsiiako, @dangtony98, @maidulll and @infisical (W23) on their $40M Series B!
Infisical is the open source security infrastructure that manages API keys, passwords, and certificates for developers, machines, and AI agents.
When an AI agent needs access to a sensitive system, Infisical hands it a fake credential and swaps in the real one through a proxy. The agent does its job without ever seeing the actual key.
More than 1,300 organizations use the platform, including Airbus, Hugging Face, and the US Government, and they just passed 30,000 stars on GitHub.
forbes.com/sites/rashishriva…
Jake Hulberg retweeted
Congrats!! I never really understood why I needed a secret store until AI came along and now I have thousands of secrets across my apps and agents that want to use them
Today, we’re announcing Infisical’s $40M Series B at a $600M valuation, led by @eladgil.
AI has made it 10x easier to write code, 10x easier to find vulnerabilities, and given autonomous agents access to some very sensitive systems.
The problem is that much of today’s security infrastructure wasn’t built for any of this.
We’re changing this with @infisical. Today, over 1,300 organizations trust us to secure their infrastructure, including Airbus, First American Financial, Hugging Face, OpenRouter, and Wise.
Proud of what our team has built so far. Even more excited about what we have ahead of us.
Back to work.
Jake Hulberg retweeted
Congrats @infisical on their $40M Series B led by @eladgil 🚀
Psyched to be the lead seed investor @GradientVC the leading platform for agent security!
We’re excited to announce we have raised a $40M Series B!
This next round of funding lets us continue to strengthen our secrets, certificate, and access management products.
We'll also expand the capabilities of Agent Vault, so engineers adopting AI agents can give them access without handing over the underlying credentials.
Thank you to @eladgil, @GradientVC, @ycombinator, and our other investors, as well as our customers, community, and team for helping us get here!
Infisical helps secure tens of billions of credentials every day across defense, pharma, finance, and physical infrastructure.
come join us to redefine how high growth startups and fortune 100s think about their security stack as ai transforms how we build software.
we’re hiring for 100+ positions across security, infrastructure, product, engineering, and more!
We’re excited to announce we have raised a $40M Series B!
This next round of funding lets us continue to strengthen our secrets, certificate, and access management products.
We'll also expand the capabilities of Agent Vault, so engineers adopting AI agents can give them access without handing over the underlying credentials.
Thank you to @eladgil, @GradientVC, @ycombinator, and our other investors, as well as our customers, community, and team for helping us get here!
The secrets are out!
Infisical is building the security platform for the agentic era - so agents can ship without leaking the keys.
Excited to be part of the journey as part of their series B.
Today, we’re announcing Infisical’s $40M Series B at a $600M valuation, led by @eladgil.
AI has made it 10x easier to write code, 10x easier to find vulnerabilities, and given autonomous agents access to some very sensitive systems.
The problem is that much of today’s security infrastructure wasn’t built for any of this.
We’re changing this with @infisical. Today, over 1,300 organizations trust us to secure their infrastructure, including Airbus, First American Financial, Hugging Face, OpenRouter, and Wise.
Proud of what our team has built so far. Even more excited about what we have ahead of us.
Back to work.
git commit -m "series b 🚀"
Today, we’re announcing Infisical’s $40M Series B at a $600M valuation, led by @eladgil.
AI has made it 10x easier to write code, 10x easier to find vulnerabilities, and given autonomous agents access to some very sensitive systems.
The problem is that much of today’s security infrastructure wasn’t built for any of this.
We’re changing this with @infisical. Today, over 1,300 organizations trust us to secure their infrastructure, including Airbus, First American Financial, Hugging Face, OpenRouter, and Wise.
Proud of what our team has built so far. Even more excited about what we have ahead of us.
Back to work.
Jake Hulberg retweeted
If you’re a Railway user acting on today’s security incident, here are some best next steps:
> Rotate any potentially exposed secrets and credentials
> Review audit logs for suspicious access
> Set up automated rotation for DB credentials and API keys
> Use short-lived, dynamic credentials wherever possible
> Consider fetching secrets at runtime instead of storing them directly in Railway
@infisical supports automated rotation for 50+ secret types, dynamic secrets, and Railway secret sync if you need a place to start.
An urgent notice from the Railway team
blog.railway.com/p/security-…
Jake Hulberg retweeted
over the past few weeks, we leaked thousands of API keys across the NYC subway!
please don't try this at home.
Jake Hulberg retweeted
Replying to @mattjay
Dropping some alpha for anyone who doesn't want their coding agent to leak their API keys.
teapawt.net/dangtony98/status/2111…
Most developers aren't aware of this hack but you can actually run coding agents without any API keys and substantially reduce any risk associated with agents leaking keys.
This is generally a best practice and we implement this using a transparent proxy at @infisical.
The general idea is that you scaffold the agent's environment to proxy all traffic through a transparent HTTP proxy. This is non-intrusive and covers all CLI, local MCP, LLM provider traffic.
On a more practical level this means:
- OpenCode invokes the GitHub CLI to raise a PR without holding a GitHub PAT.
- OpenCode connects to any LLM Provider (e.g. Anthropic) without holding any API key.
- You get the point.
We've open sourced Agent Vault which holds agent credentials as part of Infisical and Agent Proxy, the standalone companion transparent proxy that fetches back credentials and brokers them for agents like OpenCode.
Linking the docs below; you're welcome 👇
Jake Hulberg retweeted
Most developers aren't aware of this hack but you can actually run coding agents without any API keys and substantially reduce any risk associated with agents leaking keys.
This is generally a best practice and we implement this using a transparent proxy at @infisical.
The general idea is that you scaffold the agent's environment to proxy all traffic through a transparent HTTP proxy. This is non-intrusive and covers all CLI, local MCP, LLM provider traffic.
On a more practical level this means:
- OpenCode invokes the GitHub CLI to raise a PR without holding a GitHub PAT.
- OpenCode connects to any LLM Provider (e.g. Anthropic) without holding any API key.
- You get the point.
We've open sourced Agent Vault which holds agent credentials as part of Infisical and Agent Proxy, the standalone companion transparent proxy that fetches back credentials and brokers them for agents like OpenCode.
Linking the docs below; you're welcome 👇
YOUR AI AGENT SHOULDN’T READ YOUR API KEYS!
Use @infisical Agent Vault to broker keys on behalf of your agents instead.
Credential harvesting attacks against AI agents are getting more and more common. This will continue to be a problem for the foreseeable future.
If you're using OpenCode, here's what I'd do following today's breach:
1. Rotate potentially exposed API keys immediately. (@infisical can automate rotation for OpenAI, OpenRouter, etc.)
2. Stop handing raw API keys to AI agents. Use a transparent proxy like Infisical Agent Vault instead.
3. Use dynamic secrets so database credentials are short-lived rather than permanent.
4. Review audit logs for suspicious activity and unauthorized access.
Folks running cloud agents, how are you actually doing this? Are you using managed agents like Cursor, Codex, or Claude Remote? Are you using tmux, Tailscale, and an EC2 instance? Are you just SSHing in? What's the interface like?
I've been reading super complex and awesome setups by companies like Ramp, Uber, and Grab, but I've yet to find individuals hand-rolling their own cloud / remote agents setups. Do these people actually exist? Genuinely would love to learn!
Jake Hulberg retweeted
Assorted things I've been mulling over regarding agents in the economy:
• Companies are in some sense the original superintelligence. It's often the case that they can use their amortized cognitive surplus to advance their interests against those of certain consumers: relative to the optimization capacity of companies, consumers can be inattentive, underinformed, irrational, etc. (Think, say, of some of the classic insurance upsells at the end of a booking process, which is typically priced substantially above what a regular policy would cost.) Herbert Simon introduced the idea of bounded rationality, and firms often end up benefiting from it. Thanks to personal agents, we will probably get somewhat more rational in how we engage with companies.
• How exactly will outcomes change? Well, certain kinds of price discrimination will work less well (how do coupons work if every agent hunts fastidiously for them?), and certain kinds of customer cross-subsidy will change (today, people who forget to cancel subscriptions subsidize those who don't). Taken across the economy as a whole, I'm not sure what the incidence of all of this will be.
• In corporate strategy, people have long debated the relative importance of distribution and product quality. Perhaps you've made something better, but does anyone know about it? Won't people just continue to buy the ACME Corp Mousetraps? Personal agents will, I think, act as a kind of structural subsidy for product quality. How would markets look different if individuals always spent at least 10 hours researching their purchases? On the margin, focusing on making a product better is, I think, going to become a more effective strategy for companies. This is good!
• It true, a corollary is that information about product quality will become more important and impactful. Today, most people have very limited ability to aggregate and integrate such data, but agents will have insatiable thirst for such signals. (It's often said that data is becoming more valuable because it helps in the training of models. That's obviously true, but I think there's a secondary way in which it's more valuable simply as a complement to cheaper intelligence.)
• A big question is whether agents will increase superstar effects (rational agents all settle on the same product) or increase dispersion (because everyone has slightly different tastes and preferences, which agents are good at eliciting, finally overcoming the artificial clustering we've been subjected to).
• Many internet companies have monetized demand routing, which is in turn often predicated on short attention spans. "I'll click on the first thing I see." This has led to some amount of inefficiency, as companies try to propitiate capricious ranking algorithms and incur various placement fees. It's not all deadweight loss (willingness to pay is itself a kind of signal, which is valuable to buyers), but it's not great. How will the nature and value of this routing change in a world of personal agents? I don't know the answer, but I think that the effects might be pretty big.
• Much of what I'm writing hinges on the assumption that personal agents will be on the consumer's side. I suspect that that will be the winning strategy, but whether it's true, and what it means to be true, involves a lot of other questions.
Taken as a whole, the market is a massively parallelized, decentralized, and highly imperfect value attribution machine, and, taking stock of all of the effects, it seems to me that the quality point may well be the biggest: that agents will change the nature of the backpropagation such that the rewards for better products increase. Maybe this is too optimistic, but I suspect (and hope) that companies that make things that they're proud of will feel that the universe is a little more partisan in their favor.
Your agent shouldn't read your API keys!
Agent Vault is an elegant credential broker to give your agent access without giving it credentials!
A credential an AI agent can read, is a credential it can leak.
Introducing Agent Vault: a new Infisical product that lets Claude Code, Codex, and other agents call the APIs and services they need, without holding real credentials.
With Agent Vault:
> Your agents work as they normally do, with no code changes
> A prompt-injected agent can only reach preapproved HTTP services, down to exact methods and paths
> Agent sessions expire on a schedule you set, and every request is logged
Jake Hulberg retweeted
Cyber will be one of the most defining domains for AI in the coming years, and a huge area of focus for most enterprises.
AI is going to now create a whole new level of work for security dealing with the increase of vibe coded issues, agentic attacks, and even accidental agent swarms hunting for data. OpenAI + Hugging Face is just a preview of what’s to come.
Security teams have often been the most strapped for resources teams in the enterprise, and now it’s only going to get more intense. AI agents of course become the solution to this problem as well, and we’ll see a range of new agentic products for protecting code, enterprise systems, mission critical infrastructure, and enterprise data. Huge opportunity here right now.
And it’s going to be a booming market for cyber professionals that can effectively deploy agents for security purposes in the enterprise. Great time to be in security.
MY HOMELAB HAS NO .ENV FILES!
Tailscale + Infisical self hosted = insanely cool. If you're a homelabber, this is a must-see in my opinion. In this video, I go deep on how to:
- add devices to a tailnet
- self-host Infisical, Grafana and Nextcloud
- lock everything down with tags and ACLs
- fetch secrets only at runtime























