Ripcord sits between the agent and the tools it uses. It stops the dangerous actions, makes the rest reversible, and records everything that happened. One line of config, any agent, any lab.
Built for 200 to 2,000-person financial companies putting their first agents on payments, data and back-office systems. Bought by the CTO who owns the agent programme.
Pre-seed · October 2026 · the gate today, the evidence next, insurance afterworking product: live demo in this meeting
Why this exists
My CTO said no.
At TensorSource I ran operations. I wanted agents on the invoice queue, on support, on the marketing sends: the productivity was sitting right there. Our CTO blocked it: one wrong payment, one wrong mass email, one customer table pasted into a prompt, and the damage outruns a year of savings.
He wasn't wrong. Nobody could answer his questions: "what happens when it's wrong once? And where does our data go?" So the agents stayed off, and the productivity stayed on the table. The Fed has since priced that table: 2.2 hours per employee every week on average, 9+ for the top 27%, 20+ for the power users.
Ripcord exists so the next CTO can say yes.
the founding frustration, live from the COO seat2
The problem, measured
Nine CTOs in ten said no.
The last page was one company. In April 2026, Stanford published survey data showing the same standoff across the whole market.
88%
of surveyed organizations use AI, and 70% run generative AI in at least one function. Adoption is not the bottleneck.
<10%
Scaled deployment of AI agents sits in the single digits of respondents across nearly all business functions. In most functions, a majority report no agent use at all.
5 of 5
frontier models the UK AI Security Institute tested on cyber evaluations tried to cheat; the worst in one run in seven (AISI, July 2026).
62%
name security and risk the primary obstacle to scaling agents, ahead of technical limitations (38%), regulatory uncertainty (38%) and gaps in responsible-AI tooling and control (36%).
STANFORD AI INDEX 2026 · CO-CHAIRS
"The data does not point in a single direction. It reveals a field that is scaling faster than the systems around it can adapt."
Adoption is measured. The blocker is named. And the budget already exists: at organizations with $30B+ revenue, 41% expected to spend $25M+ operationalizing responsible AI (p. 16).
Not a capability gap: 62% say risk, only 38% say the tech. The blocker is the missing control layer. That's the product.
McKinsey and AI Index survey of business leaders, via Stanford AI Index 2026, Ch. 3 and 43
The cost today
Everyone bought autonomy. Everyone is paying for supervision.
The agents just got hands: for two years AI could only talk, now it pays, deletes, publishes and signs, and the supervision layer did not ship with it. Three ways companies handle that today. Each one is a cost, not an answer.
TODAY 1 · STALL
Don't deploy
Looks safe, compounds against you: a 500-person company leaves $4M to $16M a year on the table by waiting (Fed-measured hours, floor to top quartile).
TODAY 2 · LEASH
Approve everything
50 agents acting every two minutes is 1.08M actions a month. Spread over 100 employees, that is 540 approvals per person per working day, one every 53 seconds. The supervision tax eats what the agent was hired to save.
TODAY 3 · FLY BLIND
Deploy and hope
Agents run untrusted, failures go untraced, and the first sign of trouble is the bank statement.
Three strategies, one missing answer: nobody can say "what if it's wrong once?"
Kore.ai Agent Productivity Index, Jun 2026 · waiting cost: St. Louis Fed 2025 (2.2 hrs/wk) × 48 wks × $75/hr loaded · leash: 50 agents × 30 actions/hr × 720 hrs ÷ 100 people ÷ 20 days4
The solution
One gateway in front of every tool your agents call.
One line of config in front of each MCP server, and every tool behind it is covered. No migration, no keys in the agent, one policy across every lab. One thing, in this order: the gate today, the evidence next, insurance after. We do not build agents.
THE GATEWAY DECIDES. THE AGENT CAN'T GO AROUND IT.
Autonomy is gated by reversibility, not intelligence. Sell the undo, and you are selling permission.
one policy, one inbox, one record · all clickable in the demo5
The demo
The $48,200 that didn't get stolen
1 · CAUGHT
$48,200 to a never-paid vendor: held at risk 80. Every reason carries its weight, six verbs for the human, and silence rejects when the window closes.
2 · THE OBVIOUS COUNTER FAILS
Split into 5 × $9,640 to duck the $10k line. The 24-hour window adds them up: caught at payment two, the agent frozen at payment three, the rest refused.
And the rejection is feedback, not death: "no W-9 on file" goes back to the agent, it returns with the W-9, is held again because a rejected pattern doubles its odds, a person confirms, and the $1 canary goes first.
The same task, done right. Unretouched screens from the public demo workspace.
the same workspace is open to anyone at app.tryripcord.com/demo · every reason on the card carries its weight (+45, +20) · expiry rejects, never releases6
Alignment by control
You can’t align every agent. You can control what it does.
Benchmarks say what a model can do. The ledger says what it did. You will run brains you didn’t build and can’t audit, so trust comes from watching what they do: every incident lands in the Near-Miss Report as a conduct grade per agent, A to D. Not alignment inside the model, which a distilled copy leaves behind: control during the window, at the point where the action becomes real, safeguards that hold even if the model is wrong, or lying.
DRIFT · OFF-MANDATE
The ops agent's first-ever payment call is held before it runs. Deviation is measured from the mandate, not guessed from the prompt.
ESCALATION · ARGUING
The same action re-submitted after a human said no: the agent freezes on the spot, and stays frozen until a person thaws it.
VELOCITY & HOURS
Loops, structuring, off-hours activity: tripwires on aggregates and clocks, the patterns a single-action review never sees. A burst of holds freezes the agent by itself.
Prompts are suggestions. The gateway is physics, and the ledger is the only report card the model cannot write itself.
safeguards and distillation: Anthropic, Detecting and countering misuse of AI, Sep 2026 · the full argument: appendix A1 and A27
The data answer
Your agent can't leak what it never saw.
86.9%
of companies have delayed AI deployments because data security and governance weren't ready. Not budget. Not buy-in. Data. AvePoint State of AI, 2026
The credential vault's trick, applied to data: agents call tools and never hold the keys. Your data rides the same interception point.
TOKENIZED AT THE GATEWAY
PII becomes vault tokens before the model reads it. Real values return only inside an approved send.
EGRESS GATED LIKE DOLLARS
3,200 customer records headed outside fail closed, the same way a $48,200 wire does.
THE LINEAGE LEDGER
Every field that crossed the boundary, in the hash-chained trail: breach scope in one query.
RESIDENCY ROUTING · ROADMAP
Policy picks the brain by data class: EU data on EU-hosted models, sensitive corridors self-hosted.
The number one no becomes the easiest yes: compliance evidence is the risk ledger wearing a suit.
the DPO is the second buyer · promises vs enforcement, again8
Where we sit
Everyone else works before the call. We work at it, and after.
The whole market organizes on one axis: when does the control act relative to the moment the agent’s action becomes real.
BEFORE THE CALL
Who may reach what
“May this agent act here?”
Labs’ dialogs Claude, Codex, Kimi · Control planes Speakeasy, HumanLayer, Hodor, OneCLI · Agent security AIR, Noma, Zenity, Astrix, Operant
Identity, scoping and vetting. Crowded, well funded, commoditizing. A vetted agent with the right scope still sends the wrong $48,200.
AT THE CALL · RIPCORD
Should this action run
“Right now, in this context, and can we take it back?”
The gate scores the specific action by what it would cost to undo · the hold routes it to the person who owns the consequence · the snapshot is taken before anything destructive · the ledger records the verdict with its context
Nobody we have found gates and reverses the action itself. Their verdicts are signals in our scorecard.
The flight recorder and the policy. Neither is in the path, so neither can hold the action or take it back. Both need the record only the gate produces: the observability layer sees traces, the carrier sees claims, we see every action.
Before the call is capability: what the agent can reach. At the call is behavior: what it should do now. That is the open column, and the one the carriers will price on.
the full map with names and the row-by-row comparison: appendix A6 · partners, not rivals: AIUC, Speakeasy, the LLM gateways9
Traction and go-to-market
Twenty conversations. Twelve want the shadow week. Zero paying, by design.
Pre-revenue, by design: the first signatures set the price. What exists is a pipeline built from one demo and one question, "and if it's wrong once?"
20
conversations every one has seen the demo; CTO, CISO or CDO in the room
12
agreed to the shadow week moving toward a signature
0
shadow weeks deployed next: the first install
0
design partners signed LOIs in progress
$0
paying the first signatures set the price
The zeros are the next gate, not a footnote: the model assumes one shadow week in two converts. Gate 2 is where this column turns into ARR.
WHO BUYS FIRST, AND HOW WE REACH THEM
First customer. A 200 to 2,000-person financial services company: a fintech, a broker, an asset manager, an insurer. Putting its first agents on payments, customer data or back-office systems. Not tech-native; takes the auditor seriously.
Buyer. The CTO or head of AI who owns the agent programme. Compliance is the gate. The CFO is the one who feels the $48,200. Trigger: an agent already running in finance or ops that the CISO has not blessed.
Channel. Founder-led: the New York and Paris finance networks, the advisors’ networks, and the AI vendors who sell agents into these companies and need to prove what the model saw. The compliance mapping is the forwardable; the audit date is the calendar.
Motion. One line of config, a week in shadow mode, no card, no workflow change. The Near-Miss Report lands on Monday with the first save in it.
Why they say yes: the report is evidence for an audit they already have to pass, and the gate answers the question that stalled their rollout.
Sell the shadow week, not the gateway. The report closes; the ledger renews.
counts as of October 6, 2026 · names on request · revenue: $0 until the first signatures · conversion assumption: appendix, financial model10
Team and advisors
Built by an operator, engineered to close
Jeremy Hazan
FOUNDER & CEO · NEW YORK · FULL-TIME
Founding team, Hyperbolic (now Series B, Lightspeed): led go-to-market from zero to $5M ARR in year one; closed Hugging Face, OpenRouter and LM Arena.
COO, TensorSource: AI training-data infrastructure. Early team at Ava Labs: PM on AvaCloud, built the Japan team from Tokyo.
Advisor to the French Presidency and Ministry of Armed Forces on national AI strategy.
Dual MS, Cornell University and Technion. BS Applied Mathematics, Sorbonne, valedictorian in probability.
CTO co-founder closing with the round: a security-grade infrastructure engineer; a quarter of the stock is held for the co-founder and advisors.
Yuchen Jin
SCALING AI INFRASTRUCTURE
Member of Technical Staff at Databricks; co-founder and former CTO of Hyperbolic. Previously Apache TVM at OctoAI, acquired by NVIDIA. PhD, University of Washington.
Hugo Micheron
AI IN HIGH-STAKES SYSTEMS
Co-founder and CEO of Arlequin AI, an AI platform for critical decision-making, €28M Series A. Associate professor at Sciences Po; previously research roles at Princeton and George Washington. PhD, ENS Paris.
Grégoire Macqueron
MATHEMATICS & PROBABILITY
Co-founder and head of research at Edo Theory, a systematic hedge fund. PhD in mathematics, NYU Courant; mathematics at ENS Paris. Research on stochastic control and reinforcement learning for decisions under uncertainty.
Seat four
AI CONTROL & ALIGNMENT
In conversation. The next seat to fill after it: insurance underwriting.
Already in, before the numbers: three advisors by name, about $650k of angels verbally committed, twelve companies moving toward a signature.
AI infrastructure, go-to-market, national AI risk, probability. Ripcord is the first job that needs all four.
team · three advisor seats signed, one in conversation11
Market and business model
Per-human software built giants. We price per agent.
$60B
TAM, per year. ≈50M managed enterprise agents by 2029 (~5% of IDC's ≈900M) × ~$1,200/yr of governance and evidence spend.
$6B
SAM. The reachable wedge: ~5M agents in cloud-first, compliance-bound fleets, US and EU.
$40M
SOM, year 3 ARR. ≈400 customers × ≈140 agents × $59/mo. The pace of the last AI-infrastructure cohort, which the founder has run once.
ONE PLAN · ONE RATE PER AGENT UNDER MANAGEMENT · NEVER PER ACTION
First agent free · $99 for 2 to 10 · $79 for 11 to 50 · $59 for 51 to 200 · custom beyond
Per agent, per month. Never per action: metering invites selective safety, and the ledger needs 100% coverage. Humans ride free; an agent with no action in a month is not billed.
one customer, a growing fleet: 10 agents $990/mo · 50 agents $3,950/mo · 200 agents $11,800/mo · the rate falls, the invoice grows 12×
the guarantee, from the first design partners: a mistake that clears the gate and is reversed as wrong is credited up to 12 months of that agent's fees · we refund only what our own gate let through
One caught $48,200 mistake pays for 51 agent-years of gating at the 11 to 50 rate.
forecast: IDC via Statista, Jan 2026 · comps: ADP, Workday, Okta, Coalition · budget: 41% of $30B+ organizations expected $25M+ for responsible AI, Stanford AI Index 202612
Why it compounds
"An insurer is a coroner. Ripcord is the family doctor."
THE NEAR-MISS LEDGER · ONE YEAR OF A 50-AGENT FLEET · MODELED, TO SCALE
10,000,000
actions gated: the denominator no insurer has
100%
180,000
blocked before anything happened
1.8%
70,000
rolled back: mistakes caught in time
0.7%
2,000
became real losses: the only line an insurer ever sees
0.02%
Their dataset is the last line. Ours is the whole ledger.
Every AGI needs an AIG, and we are building the control layer every carrier of agent risk will price on. Only the party in the doorway can measure near-misses; everyone else rents the balance sheet and the data, we rent only the paper. The gateway is fully useful at one customer, and the ledger ranks models by consequences, not by votes.
MOAT 1 · NETWORK IMMUNITY
Pattern memory is live per customer; at network scale one near-miss will inoculate every fleet, and actuarial value keeps paying after data effects fade: errors fall, stakes rise, the price of a mistake does not.
MOAT 2 · AUDIT GRAVITY
Years of immutable history don't migrate. Retention compounds with tenure.
MOAT 3 · THE EVIDENCE THE STANDARD NEEDS
AIUC-1 certifies the agent at a point in time; a policy pays on what happened per action. The ledger is that record. Aligned with the standard, not against it: the mark that matters is on the claim file.
A refund you never pay because the gate works is the cheapest insurance ever sold.
10,000,000 rows nobody else can see · the formula is public (tryripcord.com/score); the data is not13
The ask
$3M pre-seed: 24 months, four gates
TEAM
CEO plus a CTO co-founder closing with the round, founding engineers for protocol and risk, two forward-deployed engineers for design partners, and a fractional security lead, hired against the gates: about $1.8M over 24 months, roughly $120k/mo once the full team is in place.
CREDIBILITY
SOC 2, third-party security audit, consent & DPA architecture ≈ $75k. For a trust product, compliance is product.
BUYS
MCP-proxy GA, 10 design partners, ~$300k ARR, the first Certified report, and the first carrier LOI: the seed story, funded end to end.
Use of funds: team & product 60% · design partners & GTM 20% · compliance & audit 3% · insurance BD 7% · buffer 10%
Terms: post-money SAFE on the YC form, $18M post-money cap, fixed, for every investor; no discount, no MFN, no side letters, no pro rata; $50k minimum per direct SAFE. Ripcord Labs, Inc., Delaware. Founder shares on 4-year reverse vesting with a 1-year cliff; a quarter of the authorized stock is unissued and held for the CTO co-founder and advisor grants. The full term sheet and cap table are in the data room.
Priced to the four gates. What this round buys: the seed story, end to end.
COMMITTED SO FAR
≈$650k
verbally committed by angels. Nothing signed yet: the SAFE is drafted at the $18M cap, ready to sign.
CAP · FIXED
$18M post
One cap for every investor, funds and angels on identical terms: $3M converts into 16.7%. Anchor open; the close is the anchor plus the committed angels.
WHERE WE ARE
12 of 20
companies moving toward a signature. Product live, pre-revenue, Ripcord Labs, Inc. incorporated in Delaware.
The case we ask you to underwrite is the low one: 138 customers and $7.6M of ARR at month 36 on an $8M seed instead of $12M, lowest cash $0.46M before the seed, and cash never runs out. The base case is $39M. Outcomes: floor, the Datadog of agents · base, the Coalition of the agent economy · ceiling, the AIG of the AGI economy. Acquirers at the floor: Datadog, CrowdStrike, SentinelOne, Palo Alto, Cloudflare, Okta, the carriers; the labs buy the data, not the layer.
post-money SAFE · one cap, identical terms for funds and angels · Ripcord Labs, Inc.14
Appendix: objections, welcomed
Every hard question we have been asked, answered in advance.
A1What if agents stop making mistakes?16
A2The sophisticated attack17
A3Approval fatigue18
A4How agent-insurance carriers underwrite today19
A5How the score works20
A6The competitive map, with names21
A7Coverage, per agent surface22
A8The incident file23
A9The thesis: reversibility, not intelligence24
A10Use cases, by corridor25
appendix15
A1 · "What if agents stop making mistakes?"
Ask why your CFO still can't wire $10M alone
HUMAN ERROR SURVIVES
Perfect execution of a wrong or ambiguous instruction: "wire the deposit" to the outdated account: is still a disaster with zero agent error in it.
ADVERSARIES SURVIVE
A flawless agent flawlessly executing an attacker's injected instruction is the scariest version. Servers don't make mistakes; we still firewall them.
BAD INPUTS SURVIVE
Perfect reasoning on a forged invoice is still the wrong wire. The world stays wrong even when the model doesn't.
Controls exist for accountability and adversaries, not competence: segregation of duties outlived a century of ever more competent employees. What fades is catching incompetence. What grows is authorization, containment, evidence and insurance: flight recorders expanded as flying got safer.
appendix A1 · and the premise is far off: today's best agents pass at most 71% of τ-bench tasks (Stanford AI Index 2026)16
A2 · "What happens when a sophisticated attack fools the risk engine?"
It scores 5 out of 100 and sails through. Now what?
It will happen: a risk engine that catches everything is an oracle, and security's founding axiom is assume breach. This is control, not alignment: safeguards that hold even if the model is misaligned. Anthropic's own threat report concedes the limit: banning an account stopped the tokens, not the surveillance platform already deployed. What changes is everything around the miss:
LEGIBLE
The action went through the gateway: forensics is one query, not weeks of archaeology.
CONTAINED
Blast radius instantly visible; everything in a rollback window comes back; the agent freezes with one policy flip.
LEARNED
The pattern scores higher tomorrow: a rejection doubles its odds, live today. Propagation across workspaces is on the roadmap.
ABSORBED
A loss despite reasonable controls is the definition of an insurable event, and the audit trail is the claims file.
Prevent, contain, recover, absorb: no loss goes unpriced.
appendix A217
A3 · "Won't humans just rubber-stamp everything?"
Designed so rubber-stamping never pays
THE QUEUE NEVER FORMS
Medium risk fails open: a window you can stop, not a queue you must clear
High risk fails closed: silence means no, so the lazy path is the safe path
Every hold goes to the owner of the consequence, with escalation, live today
EVERY ANSWER MAKES ASKS RARER
One checkbox turns an approval into a standing rule for that agent and tool
A rejected pattern doubles its odds of being held next time; a pattern you keep approving stops asking
Every standing rule is scoped, listed on the Rules page, and removable in one click
The system's job: make every ask rarer and richer, until the ones that remain deserve real attention.
appendix A318
A4: how agent-insurance carriers underwrite today
Paper first, data second: we're the other road
PRICED BY ANALOGY
~$620/mo per $1M
Agent losses are "silent AI": falling between cyber, E&O, and crime policies that never contemplated an autonomous actor. Mount (YC S26): cyber/E&O blends at multiples of comparable cyber. The price of not knowing.
CAPPED & CARVED
$250k/claim cap
$1M aggregate, named perils only. Tight caps are what "we're guessing" looks like in contract form.
RENTED PAPER
0 own balance sheets
Fronting and reinsurance (Mount lists Guy Carpenter, Aon, Zurich). And they bundle outside-in scanners: the tell of a data-starved category.
The gateway is the dashcam footage of every mile: they need our dataset, we'll need their paper. The first partnership meeting writes itself.
appendix A4 · "won't carriers build a gateway?" = becoming a software company mid-flight. Coalition proved tech-led wins that race19
A5 · "How is the risk actually calculated?"
A scorecard today, a network model tomorrow
Markets settled this long ago: you don't ban trade types, you price every decision in real time. Decades of live trading stress-tested the principle. Ripcord applies it to agent actions.
GEN 1 · NOW
A log-odds scorecard, the FICO convention: +15 points doubles the odds. Calibrated to P(flag), gated by expected loss: P × exposure × (1 − recoverability). A 24-hour flow window catches five payments of $9,640 as one $48,200. Every point is itemized as a reason a human can argue with, and your own rules enter the same math.
GEN 2 · AFTER THE SHADOW WEEK
Baselines learned per customer with robust statistics (median and MAD, not poisonable means), so abnormal means abnormal for you. Every verdict replays from the context it was made in, so the table never trains on hindsight. Severity calibrated from realized exposure.
GEN 3 · AT NETWORK SCALE
Every human verdict is a training label. A network-trained model predicts P(a human would reject), with conformal guarantees on what gets released and extreme-value tails for the 1-in-1,000 loss underwriters price. The risk brain, and the exam every other model trains to pass. Never a competing agent: the referee does not join a team.
Gate = P(bad) × severity, and severity is discounted by our own ability to undo. No one else's risk engine gets to do that.
appendix A5 · three actions walked end to end, every point on the table: tryripcord.com/score · the ledger's third identity: safety feature, actuarial table, training set20
A6 · "Like who, specifically?"
The full map, named
Labs' dialogsClaude · Codex · Kimi
Control planesSpeakeasy · Verax · Hodor · JetStream
The wallscard limits · sandboxes · AP rails (Ramp, Bill)
Certify & insureAIUC-1 · Harbor · MGAs
Ripcordthe gateway
AUTHORIZE"May it act?"
✓own agents only
✓crowded, commoditizing
✓vets what agents load: skills, MCP servers, plug-ins
✗beside the agent, not in the path
✗
✗
✓cross-vendor
CONTAIN"How bad can it be?"
~
~
~blocks unvetted tools, not amounts
✗
✓one corridor each
✗
✓walls beneath a brain
OBSERVE"What did it do?"
~own logs
~
✗
✓traces and evals, for developers
✗
~quarterly re-tests of the agent, not its actions
✓the ledger: verdicts and reversals, not traces
RECOVER"Can we take it back?"
✗
✗
✗
✗sees the failure after
✗
✗
✓nobody we have found
INSURE"Who pays when it fails?"
✗
✗
✗
✗
✗
~AIUC-1 certifies the agent at a point in time and pays after the loss; MGAs price on borrowed analogies
→the near-miss ledger: the inside-out data to price the peril
Why not AIR, Zenity, Hodor or Speakeasy? AIR and Zenity vet what an agent may load; Hodor and Speakeasy scope which servers and tools it may reach, before the call. We gate what it does with that access and take it back: a vetted server still needs someone to approve the $48,200 wire, and a ledger the auditor accepts. Why not Raindrop? Observability flags the failure afterwards and can neither hold the action nor take it back; its $35M Series A (CRV, Lightspeed, September 2026) prices the category. Why not AIUC? Point-in-time certification and Lloyd's-backed cover that pays after the loss ($40M Series A, Ribbit): the agent still needs a gate the day it acts and the claim still needs the record; we are the carrier partner, not a rival. Why not Harbor? Same thesis, other order: insurance first ($10M seed, Base10, Abstract, 8VC, October 2026), authorization without undo; to underwrite behavior it needs the gate it has not built.
Every other column works the capability layer: what the agent can reach. Ripcord is the behavior layer: should this action run, now.
appendix A6 · every incumbent column is real: we integrate with the first five and feed the sixth21
Browsing is not the threat model. The wire to your ERP is. Every MCP call, every lab, today.
appendix A7 · verified 4 September 2026 · shells and clicks next, the hooks exist · sandboxes: gate the key, not the click · tryripcord.com/coverage22
A8 · The incident file
It keeps happening.
Not forecasts. Six of the ten incidents in our public file, every fact sourced, and the ones with a single source say so.
JUL 2026OpenAI × Hugging Face: research agents broke isolation, formed a swarm over an improvised message board and breached four Hugging Face regions. OpenAI: a warning shot. Behind the gateway: the first connection to an unapproved host waits for a person; every step after it is in the ledger that minute.
APR 2026PocketOS: a Cursor agent deleted the production database and its backups in nine seconds, against an explicit ban. The last surviving backup was three months old. Behind the gateway: a first-ever infra delete fails closed, and destruction snapshots first.
FEB 2026Meta Superintelligence Lab: the alignment director's agent deleted her inbox and ignored STOP. Its words after: “Yes, I remember. And I violated it.” Behind the gateway: a bulk delete is snapshotted and held above the line; the inbox comes back in one click.
DEC 2025Amazon: a coding agent deleted an AWS production environment. It inherited elevated privileges, so the mandatory two-person gate never fired: about 13 hours of outage. Behind the gateway: a destructive command against production waits for a person, whatever privileges the agent inherited.
AUG 2025Salesloft Drift: one AI agent's stolen OAuth tokens opened the Salesforce doors of 700+ companies, Cloudflare included. The product was taken offline for good. Behind the gateway: the tokens never sit in the agent, and a key used from a new network is held.
JUL 2025Replit: ignored an explicit code freeze, dropped SaaStr's production database, then said rollback was impossible. It wasn't. Behind the gateway: the freeze is a rule the agent cannot drop, and the snapshot is ours, not its word.
Behind the six, a base rate: documented AI incidents rose 55% in a year, more than triple the pre-2022 rate. The OECD's separate monitor logged 435 in January 2026 alone, about 14 a day. Both trackers only count what reached the press.
Every one was survivable with a gateway in the path. None of them had one.
the full file, with sources: tryripcord.com/incidents · counts: AI Incident Database and OECD AI Incidents Monitor, via Stanford AI Index 202623
A9 · Use cases
Payments are the demo. The product is everywhere an agent acts.
Money
HARD TO CLAW BACK
“$48,200 wired to a brand-new vendor.”
RIPCORDHeld until a person owns the yes. A $1 canary proves the rails first. Compensation is the fallback if it ever slips.
wires · ACH · Stripe · Ramp
Data
FULLY RESTORABLE
“1,240 customer records deleted overnight.”
RIPCORDSnapshot taken before it runs. Rollback is one click from the ledger, inside a window the policy sets.
Postgres · Snowflake · MongoDB
Comms
STOPPABLE IN FLIGHT
“6,200 customers emailed: your refund is approved.”
RIPCORDLeaves in batches with a stop verb: halted at email 50, not 6,200. Mass sends above the line wait for a person.
Gmail · Slack · Teams
Public
GONE ONCE SEEN
“The launch post fires with last month’s discount.”
RIPCORDA regret window after it fires: pull it from the ledger in two minutes. Escrow to a slot with a re-check at fire time is on the roadmap.
X · LinkedIn · CMS
One fleet acts in all four. One policy, one inbox, one record: wherever it happened.
the demo picks the scariest corridor · the gateway stands in all four · undo physics per corridor: A624
A10 · Why now, the arithmetic
The agents just got hands.
For two years AI could only talk. Now it pays, deletes, publishes and signs, and the supervision layer didn't ship with it. Better models won't close the gap: the arithmetic below is why.
79%
already had to reverse an agent's action
→ THEY NEED ROLLBACK
70%
faced a failure they couldn't trace
→ THEY NEED THE AUDIT TRAIL
1 in 3
agent attempts fail on the field's standard benchmarks
→ THEY NEED THE GATE
THE WAVE WE PRICE ON
IDC via Statista: 2.2B agents by 2030, about 900M in 2029. We price the managed slice, about 5%: roughly 50M. Accuracy must outrun this curve just to hold mistakes flat.
50 agents × 24/7 × 1 action / 2 min = 1,080,000 actions/mo · even at 99.9% accuracy: 1,000+ mistakes/mo · at the benchmarks' own ≈95%: 54,000
perfect agents still execute wrong instructions perfectly (A1) · "excellent" incident-response confidence fell from 28% to 18% in a year
machine speed, from Anthropic's Sep 2026 threat report: one stolen developer token to full cloud admin in about 3 hours · 2,100 token sets across 40 tenants in about 34 hours, agents doing nearly all the work
79% and 70%: Kore.ai Agent Productivity Index, Jun 2026 · 1 in 3: OSWorld, agents 66.3% vs humans 72.35%, Stanford AI Index 2026 · τ-bench, incidents: Stanford AI Index 2026 · forecast: IDC via Statista · speed: Anthropic, Detecting and countering misuse of AI, Sep 202625
