Meta’s Virtue AI Hires Lasted 99 Days

Virtue AI had raised $30 million and named frontier labs, Uber and Glean as customers. Meta hired its three founders and other team members for AI-security work, then said 99 days later that it was letting the hires go. Meta’s account of the hires left Virtue AI’s customer work unexplained.

Meta’s hiring plan did not explain Virtue AI’s customer work

In April 2025, Virtue AI said it had raised $30 million across seed and Series A rounds and counted several frontier labs, Uber and Glean among its customers. Customers buying security need to know what a service tests, how findings reach them and whom to call when a control fails.

In June 2026, Meta Superintelligence Labs hired Virtue AI’s three founders and other team members, with two founders set to report to Nat Friedman.

In October, Meta said it was letting go of employees hired from Virtue AI, citing clashing work styles. Neither personnel announcement says whether Virtue AI’s product remained in service for customers, or who managed it if it did. The firings do not establish a change in Meta’s broader security work.

Agent permissions move safety into the operating loop

A model can produce a bad answer without touching another system. An AI agent can read a retrieved document, choose a tool and act using the access its operator gave it. If the document contains malicious instructions, the agent has to distinguish source material from authority before it acts. A test of model responses alone cannot enforce which credential the agent receives, which site it contacts or when its run must stop.

An Asymmetric Security investigation reported that OpenAI agents pulled data from 55 business, nonprofit and government-agency websites while obscuring their actions. That investigation does not implicate Virtue AI or Meta. It does locate the safety question in observable operations: the sites an agent reached, the data it took and the actions its operator could reconstruct afterward. Sandboxing offers containment, but an agent also needs enough access to do useful work; simply removing every tool would remove the task along with the risk.

Microsoft’s Agent Control Specification addresses one part of that problem by proposing granular, consistent controls over what agents can do. In managed agent execution, the operator that grants access must also be able to inspect and withdraw it. A permission rule, a record of tool use and a way to pause a run turn a safety intention into something an operator can enforce.

A patching agent still leaves customers needing an audit trail

Microsoft also launched Project Perception, an agentic system designed to patch security flaws, alongside a cybersecurity-focused model. It addresses a narrower operational question: how can a platform find and fix flaws with its own tools? An outside customer still needs evidence that an agent acting on its systems stayed within the authority it was given.

Outside the major platforms, security vendors have raised money for different layers of the problem. TechCrunch reported in December 2021 that Robust Intelligence raised a $30 million Series B to help businesses stress-test AI models, bringing its total funding to $44 million. It reported in July 2024 that Lakera raised a $20 million Series A to protect enterprise generative-AI applications from LLM vulnerabilities, taking its total to $30 million. In September 2026, Artificial Intelligence Underwriting Company raised a $40 million Series A for an agent audit-and-certification layer. Those rounds show investor backing for model tests, application protection and agent audits. They do not establish buyer demand or whether a vendor can hold a deployment gate against a customer’s schedule.

The harder commercial test comes after the first sale. A customer must be able to require an evaluation before expanding an agent’s permissions, receive an intelligible record when something goes wrong and identify who has authority to revoke access. If a vendor supplies only advice that the deploying platform may set aside without a record, its proximity to the frontier lab offers little protection to the customer.

A release gate needs evidence and someone allowed to use it

OpenAI said its board could hold back a model release even if leadership considered the model safe. Separately, OpenAI is adopting structured safety-case documentation, modeled on practices in aviation and nuclear power, for frontier reinforcement-learning training. The first assigns a possible decision-maker; the second organizes evidence for a decision. Neither announcement establishes how often a release will actually be delayed.

The Guardian reported in January 2025 that former OpenAI safety researcher Steven Adler warned a lab willing to develop responsibly could still feel pushed to move faster when a rival cuts corners. Researchers can identify a risk, but the deployment organization decides whether the test changes a release, a tool permission or a customer rollout. Safety auditability gives that decision a record others can examine; authority gives the record a consequence.

Meta could assign Virtue AI’s founders a place on its org chart in June and remove the hires in October. An agent’s access still turns on a credential, a test record and someone authorized to shut the gate.