Palo Alto Networks Reportedly in Talks to Buy Clutch Security, a Startup That Tracks AI Agents' Passwords, for About $500 Million

Palo Alto Networks is in talks to acquire Clutch Security, an Israeli startup whose software tracks the passwords and authentication codes used by AI agents, for approximately $500 million, according to a report by The Information citing people familiar with the matter. The discussions are ongoing and may not lead to a transaction, and neither the reported price nor the deal itself has been confirmed by either company.

Clutch sits in a category that barely existed two years ago: credential and identity management for non-human actors. As enterprises wire AI agents into daily operations, those agents accumulate legitimate passwords, API keys and authentication tokens, and someone has to keep track of what each agent can touch. Clutch's product builds that inventory and monitors it, flagging when an agent reaches for credentials it should not have.

The startup has raised more than $20 million from investors including Lightspeed Venture Partners and SignalFire, per the report. It is small compared with the acquirer, but the strategic fit is the point rather than the revenue.

The rationale tracks with what security teams keep running into: agents act with valid credentials, so nothing looks like an intrusion. A misconfigured or over-privileged agent can read data and consume compute far beyond its mandate without tripping a single traditional alarm, and when several agents chain their actions together, tracing what happened after the fact becomes genuinely hard. Regulators are also starting to ask organizations to explain how agent permissions are assigned and monitored, which turns audit trails for agent behavior into a compliance requirement.

For Palo Alto Networks, the deal would extend a platform push that is already paying off. The company's next-generation security ARR has reached $9.1 billion, and its shares have climbed about 89 percent this year as investors reward its shift toward platformization.

The timing is no coincidence. This week CrowdStrike closed deals worth a combined $495 million for Fiddler AI and Dreadnode, covering agent observability and pre-deployment AI red-teaming. Credential security for agents is shaping up as the next contested shelf in the platform vendors' race to cover the full agent lifecycle, and whoever owns it can argue they own the layer where agents become dangerous.