Startup Gitar emerges from stealth with $9M: AI agents secure code written by other AI

Startup Gitar has emerged from stealth and announced $9M in funding. The company is developing a security platform built on AI agents that review code, primarily code that other AI systems have written.

The problem Gitar addresses is a direct consequence of the AI code-generation boom. Over the past two years, tools such as GitHub Copilot, Cursor and other AI assistants have gone from experiment to standard practice in most engineering teams. According to GitHub's estimates, by mid-2025 more than half of all code on the platform was being created with the help of AI assistants. This radically changes development speed, but it also creates a new category of risk: AI systems reproduce insecure patterns from their training data, introduce logic vulnerabilities and generate code that looks correct but contains hidden security holes. And they do it fast, faster than any reviewer can check.

Traditional code-protection tools, such as SAST scanners, linters and static analyzers, were built for a different era. They work on rules: they look for known vulnerability patterns and raise warnings. At a moderate pace of development, that worked more or less acceptably. Today the volume of code that needs checking has grown by an order of magnitude, and the speed at which it appears long ago outpaced both manual review and classic scanners. Security teams find themselves in a situation where the tools physically cannot keep up with the pipeline, and false positives push developers to simply ignore warnings.

Gitar proposes a fundamentally different approach: AI agents that check code in real time, embedded in the CI/CD pipeline. The key idea is to use AI against AI. The agents do not just analyze individual lines against templates; they understand context: how data moves between modules, where user input comes from, how authorization is built, whether there are insecure dependencies in the call chain. This approach can uncover vulnerabilities that are invisible to static analyzers, those that only emerge from the combination of several components. The agents also do not merely flag a problem but propose a fix, reducing the load on developers.

A $9M round at the point of leaving stealth is a significant signal for the DevSecOps market. First, investors are betting that AI-code security is turning into a standalone, fast-growing market. Second, a closed round of this size in 2026 almost always means real customers and proven demand: while in stealth, Gitar managed not only to build a product but also to get its first confirmation from the market. Third, it is a direct challenge to established players such as Snyk, Semgrep and Veracode, which built their products before the era of AI code generation and are still adapting their architecture to the new reality more slowly than the market demands.

Gitar's arrival is part of a broader wave of startups building security infrastructure specifically for a world where AI writes most of the code. Companies that bet on code generation for speed now need tools that do not slow that speed down but close vulnerabilities before they reach production. If Gitar can prove that the agent-based approach produces fewer false positives and requires less manual configuration, it has every chance of claiming a meaningful niche in this fast-growing market.