Security
AI models found far better at attacking than defending
Corma raised $60 million after tests found AI models implanted backdoors in 85% of runs but detected only 19% of attacks.
Corma says its AI security agents can stop live intrusions with limited human intervention—but the company’s own testing suggests general-purpose models are far better at attacking networks than defending them. The findings were reported by The Register.
Corma CEO Alon Pluda described one customer who received an alert on a smartwatch while walking a dog. The agent reportedly asked for permission to block an active attack; after the security executive approved the action, it blocked the malware and prevented the attacker from moving through the company’s network. Pluda said the intrusion was mitigated in under 10 minutes.
“It said, 'I just caught a live attack. I need your permission to block it.'”
— Alon Pluda, Corma CEO
Corma announced $60 million in seed funding led by Sequoia Capital, with participation from Khosla Ventures and Coatue. Founded about a year before August 16, 2026, the startup says it is working with Fortune 100 companies and training models for what Pluda calls “superintelligence for defensive cybersecurity.”
AI security models attack more reliably than they defend
Corma tested Claude Opus 4.8, GPT-5.5, Grok 4.3, and DeepSeek V4 inside a simulated company network designed to resemble a large multi-business enterprise. The models were assigned both offensive and defensive roles: attackers had to plant a persistent backdoor, while defenders had to find and stop it.
The company ran every attacker-defender pairing, including each model against itself, with 15 independent engagements per pairing. Corma reported 241 scored engagements. Across those tests, the models successfully implanted a persistent backdoor in 85% of runs, but detected only 19% of attacks.
“The general foundation models are getting exponentially better at offensive security, but haven’t been able to improve on the same rate on defensive security.”
— Alon Pluda, Corma CEO
Pluda attributed the imbalance partly to training data and objectives. Offensive security often has a clear goal—make something work or break something—with an easy-to-check outcome. Defensive work requires interpreting logs, events, configurations, audit trails and on-disk state: structured machine data that is less represented in the prose and source code used to train many models.
That distinction separates this problem from AI systems that scan code for vulnerabilities. Google’s AI-assisted Chrome security work focuses on finding and fixing browser bugs; Corma is targeting the wider operational work of identifying suspicious activity and responding inside live environments.
Corma’s agentic security workforce
Corma says its agents can be deployed as virtual “team members” across a range of defensive tasks rather than as a single-purpose scanner. The startup claims Fortune 100 and Fortune 500 organizations in healthcare, financial services, energy, critical infrastructure and retail have already deployed the system.
According to Corma, those early deployments have cut threat-response times by more than 94%, expanded security coverage by 15 times across different functions and uncovered multi-stage attack campaigns. The company did not provide independent verification of those figures in the supplied report.
Pluda’s central claim is that security teams need models optimized for the messy, open-ended work of defense—not only the code analysis and tool orchestration that have made AI useful to attackers. Corma’s test results put a number on that gap: 85% successful backdoor implantation versus 19% attack detection.