Hex Security (YC W26)

AI for Offensive Security at Scale

[Hex Security (YC W26) @_hex_security]

Open source doesn't have to die.

Over the past few months we've had dozens of conversations with open source maintainers. The same story keeps coming up: exploits are accelerating, security budgets are nonexistent, and teams are stretched thin.

@pumfleet and the https://t.co/1aPO8Mhe6V team have been great to work with on security. They're making a hard call to protect their users and we respect that.

But security through obscurity has never been the answer. Open source is worth defending, not abandoning.

So we're partnering with open source projects to provide our AI review agent for free.

If you maintain an OSS project and want in, apply at https://t.co/zuApuLKQDF

[Bailey Pumfleet @pumfleet]

Open source is dead.

That’s not a statement we ever thought we’d make.

@calcom was built on open source. It shaped our product, our community, and our growth. But the world has changed faster than our principles could keep up.

AI has fundamentally altered the security landscape. What once required time, expertise, and intent can now be automated at scale. Code is no longer just read. It is scanned, mapped, and exploited. Near zero cost.

In that world, transparency becomes exposure. Especially at scale.

After a lot of deliberation, we’ve made the decision to close the core @calcom codebase.

This is not a rejection of what open source gave us. It’s a response to what risks AI is making possible.

We’re still supporting builders, releasing the core code under a new MIT-licensed open source project called cal. diy for hobbyists and tinkerers, but our priority now is simple:

Protecting our customers and community at all costs.

This may not be the most popular call.

But we believe many companies will come to the same conclusion.

My full explanation below ↓

[Huzaifa @hzzzaifa]

We've built the world's best hacker.

In 3 weeks our AI agents found critical vulnerabilities in dozens of companies, including unicorns. Over $250K earned in bug bounties.

None of them thought they were vulnerable.

This is just the beginning.

[Hex Security (YC W26) @_hex_security]

@dazzeloid working with @dazzeloid has been the best past of YC.

[James Evans @dazzeloid]

if i were a software company i would be terrified not to work with @_hex_security

[Y Combinator @ycombinator]

.@_hex_security is building AI agents that hack your systems before real attackers do.

In weeks, their agents uncovered critical flaws at dozens of unicorns, earning over $250K in bounties. Hex already protects companies processing billions in transactions and millions of user records.

Congrats @zer0day, @menace_codes, and @hzzzaifa on the launch!

https://t.co/To8F4TQ3Hn