Software Built for AI Agents Market Analysis

Most software still assumes its user is a person sitting in front of a screen. AI agents break that assumption. To operate independently, they need their own identity, a way to communicate and pay, controlled access to tools, memory that persists across tasks, and environments in which they can browse or run software. A new group of startups is rebuilding these basic services around agents rather than humans. This landscape examines how this emerging software stack is taking shape, which parts are already attracting customers and capital, and where the most important infrastructure layers may emerge.

Identity, Credentials & Permissions

What is this category about?

• The security layer that allows an AI agent to act as an accountable software user. An agent needs to identify itself when it connects to an external system, prove which person or organization it represents and receive only the authority required to complete its current task.

• Existing identity infrastructure was not designed for software that decides dynamically which actions to take. A traditional application follows predefined code paths, while an agent may choose between tools and adapt its plan as it receives new information. Giving it a human password or a broadly permissioned service account therefore creates much more access than the task normally requires.

• Credentials also need to remain separate from the agent’s reasoning environment. Agents consume information from websites, emails and external tools that may contain malicious instructions. A compromised agent becomes considerably more dangerous when API keys or login credentials are directly available inside its context.

• The broader problem is making autonomous activity governable. Companies need to know which agent performed an action, who authorized it and whether the permission was still valid at that moment. The access layer must therefore support narrow permissions, temporary authorization and immediate revocation while preserving a record that security teams can investigate later.

What do products in this category do?

• The first approach isolates credentials from the agent itself. OneCLI operates as a network gateway that inserts a secret only when a request reaches the external service, which means the underlying API key never enters the model’s context. Clavitor follows a similar principle through an encrypted credential vault, while Multifactor’s Checkpoint allows an agent to use an online account without revealing the password behind it.

• The second approach places an authorization runtime between the agent and its tools. Arcade.dev manages the OAuth connection and evaluates whether the agent is allowed to execute a particular action for a particular user. Alter is building around the same control point, issuing scoped access and applying policies before a request reaches the external API.

• A third approach treats every agent as an identity that needs to be managed throughout its lifecycle. Agentic Fabriq gives agents a verifiable identity and connects it with permissions, audit records and revocation. The company has gradually expanded this idea toward an inventory where an organization can discover active agents and remove their access when they are no longer needed.

• The products are already converging toward broader control platforms. OneCLI has expanded from credential isolation into rate limits and approval flows. Arcade.dev has moved beyond OAuth management into contextual authorization and enterprise governance, while Multifactor combines authentication with authorization and a durable record of agent activity. The likely end state is therefore not a collection of separate security utilities, but a unified layer that controls how agents access external systems.

What types of customers are using these products?

• Developers building agent products are the clearest initial users. They need a way to connect agents with external services without building credential storage and authorization infrastructure internally. NanoClaw, for example, adopted OneCLI as its default credential layer so agents created through the framework can access services without holding the raw secrets themselves.

• Agent platforms are also integrating these products as part of their underlying infrastructure. Bitwarden connected its Agent Access SDK with OneCLI so a human can approve access inside the vault while OneCLI enforces the permission when the agent makes the request. This type of integration allows the security layer to reach many agent applications through a single platform relationship.

• Enterprise identity and security vendors represent another important customer and distribution channel. Arcade.dev has worked with Cisco Duo on step-up authorization for sensitive agent actions and with Akto on monitoring the interactions between agents and external tools. These partnerships suggest that agent authorization will increasingly be purchased as part of the existing enterprise security stack rather than as a completely separate system.

• Public evidence of large end-customer deployments remains limited. Most of the current GTM activity consists of developer launches, ecosystem integrations and the introduction of enterprise pricing. This indicates that the category is still proving the technical architecture before vendors can publish a mature library of named customer deployments.

What are the major trends shaping this category?

• Authorization is becoming one of the central standardization problems for the agent ecosystem. The Model Context Protocol (MCP) has introduced stable enterprise managed authorization so companies can provision access through their existing identity provider instead of asking every user to approve every server connection separately. Anthropic, Microsoft and Okta are among the early adopters, showing that agent access is beginning to move from experimental integrations into managed enterprise infrastructure.

• Enterprise identity systems are expanding from managing employees to managing an agent workforce. Cisco has introduced capabilities that register agents, associate them with an accountable human owner and restrict them to temporary permissions for specific tools. NIST has also launched work focused specifically on the identity and authority of software agents, which suggests that agent identity is becoming a formal extension of identity and access management rather than a niche AI security feature.

• Security is moving from approving a connection toward authorizing each important action at runtime. An agent may be legitimately connected to a system and still attempt an unsafe operation after interpreting a malicious email or webpage. New OpenID specifications address situations where an action requires additional consent or approval, while NIST research highlights indirect prompt injection as a persistent risk when agents consume untrusted external information.

• Delegation across agents and organizations is becoming the next technical challenge. An agent may ask another agent to complete part of a task, but the second agent should receive narrower authority rather than inheriting every permission of the first. Emerging IETF proposals are developing verifiable delegation chains and constrained tokens, while the OpenID Foundation is testing whether MCP clients and servers from different vendors can preserve identity and authorization across organizational boundaries.

How does the funding environment look?

• The category has attracted at least $87 million in disclosed funding across Arcade.dev and Multifactor. Arcade.dev accounts for $72 million of this amount, including a $60 million Series A, while Multifactor raised a $15 million seed round.

• Capital is heavily concentrated around the companies building the broadest enterprise control layer. Arcade.dev began with authenticated tools but has expanded into an authorization runtime that governs agent actions across business systems. Its funding suggests that investors see greater platform potential in owning the enforcement point between agents and software than in providing credential storage alone.

• Most of the category remains at a much earlier stage. Alter, OneCLI, Clavitor and Agentic Fabriq do not yet have comparable disclosed institutional rounds in Axomap. Multifactor, Alter and OneCLI have all passed through Y Combinator, which shows that much of the experimentation is still happening through small technical teams testing new security architectures before a clear market structure has formed.

Payments & Financial Accounts

What is this category about?

• The financial operating layer that allows an AI agent to participate in the economy. An agent needs a way to hold funds and complete transactions without requiring a human to enter payment details each time. The infrastructure must make money programmable while preserving the controls normally applied to an employee or software application.

• Traditional payment products assume that a person is present during the transaction. The user creates an account, completes identity checks and confirms the purchase through a visual checkout. An agent needs the same outcome through a machine-readable workflow that can execute without stopping for manual provisioning. HTTP-native payment protocols are emerging partly because existing account and subscription flows create too much friction for autonomous software.

• The central problem is not only moving money, but proving that the agent was authorized to move it. A user may allow an agent to spend up to a defined amount at a particular merchant while requiring approval for anything outside that mandate. The payment layer therefore needs to preserve the original intent and produce a record showing why the transaction was permitted.

• The category must connect two very different forms of commerce. Agents increasingly purchase digital resources such as data or compute through small usage based transactions. They also need to pay conventional merchants through cards and bank accounts. The infrastructure must therefore make machine native payments work alongside the financial rails businesses already use.

What do products in this category do?

• The first approach gives the agent a complete financial account. Natural provides wallets and banking infrastructure through which agents can hold or transfer funds, while Sponge combines wallets with cards and bank payment workflows. Catena is developing the same idea for corporate treasury, where agents operate inside policies defined by the organization. These products resemble financial operating systems more than individual payment APIs.

• The second approach delegates an existing payment method without exposing it to the agent. Allowance creates one-time virtual cards that remain restricted to an approved purchase. AgentCard has expanded this model into wallets and merchant scoped cards, while Nevermined lets an agent use a delegated card within predefined spending limits. The customer can continue using familiar card infrastructure while the agent receives a temporary authority rather than the underlying credentials.

• A third approach creates a pay-per-use layer for digital services. Locus gives agents one balance that can be used across paid APIs, while AgentCash provides a wallet and discovery interface for services protected by machine-payment protocols. Orthogonal combines payment with a catalog of external capabilities, and Sponge lets an API provider place a payment gateway in front of an existing endpoint without changing the underlying product.

• The fourth approach extends the payment layer into checkout and merchant acceptance. Rye gives agents a programmatic route through product discovery and checkout across existing merchants. Skyfire combines payment with agent identity so a merchant can verify who is making the purchase and whose authority the agent represents. The products are therefore converging from both sides of the transaction: some begin by helping agents spend, while others begin by helping businesses sell to them.

What types of customers are using these products?

• AI application developers are the most common initial users. They need payment functionality inside a research agent or shopping assistant but do not want to build a financial stack themselves. AgentCard distributes through MCP and coding-agent integrations, while Rye has used a ChatGPT application to demonstrate how its checkout infrastructure can power a consumer-facing shopping experience.

• The public evidence remains more partnership-led than customer-led. Most companies share integrations and technical demonstrations rather than named enterprise deployments with measurable outcomes. This suggests that the category is still establishing the payment architecture and distribution ecosystem before a mature group of repeat buyers has emerged.

What are the major trends shaping this category?

• Agentic payments are moving from prototypes into live payment networks. Mastercard has completed authenticated agent transactions with banks in several markets, including Germany, while Visa has partnered with OpenAI and launched an integration layer that connects agent builders with merchants and payment providers. The opportunity for startups is becoming more credible, but incumbents are also moving rapidly into the same infrastructure layer.

• The market is developing a stack of complementary payment protocols rather than one universal standard. UCP describes how agents interact with merchants, while AP2 records the authority behind a transaction. ACP connects AI interfaces with checkout, and x402 or MPP make machine-to-machine payments possible at the API layer. Payment startups will increasingly need to support several standards rather than building their business around only one.

• Payment authorization is becoming more granular than conventional card approval. Google’s AP2 uses signed mandates to bind a payment to an earlier user instruction. Mastercard is creating agent specific tokens, while Stripe uses single purpose payment credentials so an AI application never receives the buyer’s real card details. These mechanisms turn the original user intent into an enforceable part of the transaction.

• Stablecoin payments and traditional card infrastructure are beginning to converge. x402 makes small payments for APIs practical, while card based products allow agents to purchase from merchants that have never adopted an agent protocol. Stripe now supports both x402 and MPP alongside conventional checkout, and Visa is positioning its network as an integration point across protocols and token vaults. The strongest infrastructure may therefore route each transaction through the rail that best matches the purchase.

How does the funding environment look?

• The category has attracted at least $122.6 million in disclosed funding across the companies tracked in the landscape. The capital remains concentrated among a relatively small group, while most of the newer virtual card and wallet products have not disclosed institutional rounds.

• The largest financings have gone to companies presenting themselves as broad financial platforms. Natural raised a $30 million Series A only months after launch, bringing its total funding above $40 million. Kite has raised $33 million and is building identity and payment infrastructure at the network level, while Catena secured $18 million to pursue an AI-native financial institution rather than a narrow payment feature.

• The investor base reflects the market’s position between fintech and crypto infrastructure. Natural has attracted conventional fintech and consumer investors, while Kite is backed by PayPal Ventures and General Catalyst. Catena’s investors include a16z crypto and strategic participants from the stablecoin ecosystem. This overlap suggests that neither card infrastructure nor onchain settlement has yet established itself as the dominant model.

Communication Channels

What is this category about?

• The communication layer that allows an AI agent to exist as a reachable participant rather than operate only inside an application. An agent needs an address or phone number through which people and software can contact it directly. This endpoint must persist across tasks so the agent can receive a response hours or days after initiating an interaction.

• Traditional communication products are designed around human owned accounts. Creating a mailbox normally requires a person to complete signup and manage credentials, while phone services assume that a human controls the number. Agent communication infrastructure replaces these account oriented workflows with APIs that can provision an endpoint programmatically and assign it to a particular agent.

• The channel must support two way communication rather than simple outbound delivery. A transactional email API can send a notification, but an autonomous agent needs to follow a conversation and react when a reply arrives. The same applies to calls and messages, where inbound activity must be routed back into the agent’s runtime together with the relevant context.

• Trust becomes more difficult once agents can initiate contact independently. Businesses need to know which agent is communicating and who authorized it, while recipients need protection from unwanted automated outreach. These products must therefore combine communication with identity, access controls and a durable history of every interaction.

What do products in this category do?

• The most common approach gives each agent its own programmable email inbox. AgentMail creates persistent inboxes that agents can operate through an API, while AgentPost offers a narrower MCP native mailbox product. Primitive uses ordinary email as the underlying transport but adds hosted functions that can execute code whenever a message arrives, allowing the inbox itself to become part of the agent workflow.

• A second type of products give agents access to the telephone network. AgentPhone provisions dedicated numbers and routes calls or messages back into the agent application. It has expanded from basic telephony into hosted voice conversations, which means the provider can manage the call directly rather than requiring the customer to operate the voice runtime.

• Inkbox treats communication as part of a broader agent identity. Instead of selling a separate inbox or phone API, it creates one persistent identity around which the agent’s communication channels are organized. An agent can use the same identity when sending email, receiving a call or exposing itself through an internet endpoint, giving the developer one control layer across otherwise separate systems.

• The products are moving from transport infrastructure toward communication orchestration. AgentMail has added tenant isolation and scoped credentials so platforms can manage many agent inboxes safely. Primitive can send a message and wait for the threaded response as a single agent action, while Inkbox and AgentPhone expose communication directly through MCP compatible tools. The value is gradually shifting from delivering a message to managing the full interaction lifecycle.

What types of customers are using these products?

• Autonomous sales products are one of the clearest early customer groups. AISDR uses hundreds of AgentMail inboxes to operate outbound agents that research prospects and manage replies without a human controlling each mailbox. The company reported sending thousands of emails each week through the platform, showing why agent applications need programmatic provisioning rather than manually configured user accounts.

• Multi-agent workspaces need a separate communication identity for every role inside the system. Cofounder gives each departmental agent its own inbox so the agents can interact with customers and external businesses independently. More than 800 emails passed through these inboxes during its first week, without the company building an internal email infrastructure layer.

• Browser agents use email as part of account creation and web automation. Browser Use gives agents an inbox so they can register for online services and complete verification steps without handing the task back to a person. In this case, email is not primarily a conversation tool but a capability required for the agent to function as an ordinary internet user.

• The products are also reaching companies that embed agents inside existing business workflows. Balance uses an agent inbox for an AI accountant handling client requests, while Eragon uses email as an input and action surface for workspace agents. LiveKit and Vercel have become distribution partners for communication infrastructure aimed at voice agent and application developers, suggesting that many customers will encounter these products through the platforms on which they already build.

What are the major trends shaping this category?

• Voice agent infrastructure is moving closer to the public telephone network. OpenAI’s Realtime API now supports SIP calling, allowing developers to connect voice agents directly with phone systems while giving those agents access to external tools through MCP. As the model layer handles more of the real-time conversation, communication startups can focus on provisioning numbers and managing the operational layer surrounding the call.

• Communication capabilities are becoming installable inside general purpose AI environments. OpenAI’s Apps SDK is built on MCP and allows external services to be invoked directly from a ChatGPT conversation. This creates a new distribution model in which an email or phone provider is not merely integrated into an application by a developer but can be discovered and activated by the agent inside its existing interface.

• Voice agents face a stricter regulatory boundary than text based agents. The US Federal Communications Commission has confirmed that AI generated voices fall under the existing restrictions for artificial or prerecorded calls. Outside limited exceptions, prior express consent is required, which makes consent records and accurate identification important parts of production telephony infrastructure.

How does the funding environment look?

• Only $6 million of disclosed institutional funding is currently recorded across the five companies in this category. The entire amount comes from AgentMail’s seed round, led by General Catalyst with participation from Y Combinator and Phosphor Capital. Inkbox is marked as seed-stage and AgentPhone as pre-seed, but Axomap does not contain disclosed round amounts for either company.

• The first meaningful financing has gone to the company showing the clearest production usage. AgentMail has expanded beyond its original inbox API into infrastructure for custom domains and multi-tenant platforms. Its customer evidence also includes agent products operating hundreds of inboxes, making the investment case more concrete than the largely product-led signals visible elsewhere in the category.

• The category remains unusually early compared with other parts of the agent infrastructure stack. Three of the five companies were founded in 2026, and most are still operated by very small teams. Product launches and YC participation are currently stronger signals than large financings or established enterprise sales activity.

Compute & Interaction Environments

What is this category about?

• The execution layer that gives an AI agent somewhere to perform work. A model can decide what action to take, but it still needs a browser or computer in which it can open applications and manipulate files. These products turn compute from a generic cloud resource into a workspace designed for autonomous software.

• APIs cannot reach every workflow an agent may need to complete. Many business processes still happen through dashboards and desktop applications built for people. Computer use models address this by interacting through the same graphical interfaces as a human, using screenshots together with virtual mouse and keyboard actions.

• Agent workloads behave differently from conventional cloud applications. A normal service repeatedly executes predetermined code, while an agent may install software and change its approach as a task develops. Its environment must be created quickly but still preserve enough state for the agent to pause and resume the work later.

• The environment also limits the damage an agent can cause. Giving a model access to a browser or terminal creates a path to credentials and internal systems. The infrastructure must isolate each task and make the resulting actions observable so that a failed or manipulated agent does not gain unrestricted access to the customer’s infrastructure.

What do products in this category do?

• Browser infrastructure gives agents a controlled way to operate websites. A developer connects the agent to a remote browser that can open pages, click buttons, complete forms and maintain logged-in sessions. Kernel illustrates this approach well: it does not give the agent a complete computer, but handles the browser, authentication and anti bot complexity required for web based tasks.

• Cloud desktops give agents access to a full graphical computer. The agent can move between a browser, desktop applications and local files in the same environment, much like a remote employee using a virtual desktop. Orgo follows this model, providing a computer the agent can see and control rather than limiting it to browser or API interactions.

• Sandboxes provide isolated environments for running code and completing software tasks. An agent can install packages, execute scripts, clone repositories and create files without receiving access to the customer’s underlying infrastructure. E2B illustrates this approach by creating a separate cloud machine for each agent task, which can remain active while a longer workflow is completed.

• The broader platforms are combining these environments with the surrounding operational layer. Blaxel, for example, adds persistent storage that can be shared across agents and sandboxes. This means the environment no longer only provides temporary compute: it also preserves the files and state needed for several agents to collaborate on the same workflow.

What types of customers are using these products?

• General purpose agent products use these environments as the computer behind the application. Manus uses E2B to give its agents virtual machines in which they can run code and browse the web. Anything also uses E2B for app generation workloads serving more than one million users, showing how the same infrastructure can sit behind a consumer product without being visible to the end user.

• Enterprise agent platforms need a controlled execution layer for customer workflows. StackAI uses E2B for code and computer use tasks in regulated industries, while Runwork uses Blaxel’s stateful sandboxes for collaborative enterprise automation. Blaxel reports that the latter reduced execution time by a factor of ten, although the result comes from the company’s own customer study.

• The same infrastructure can also replace conventional browser and automation systems. DeveloperHub moved its prerendering workload to Lightpanda and reported a tenfold reduction in server load. Browserbase names companies including Shopify and Ramp among teams building browser agents on its platform, indicating demand from existing software companies as well as AI-native startups.

What are the major trends shaping this category?

• Computer use is becoming a standard capability of frontier models rather than a separate research project. OpenAI has made computer use available through its Responses API, allowing a developer to connect the model to an external browser or desktop environment. This shifts part of the differentiation away from the agent’s ability to click and toward the reliability of the computer it is given.

• The market is moving from disposable sandboxes toward persistent and forkable computers. Longer tasks require the environment to preserve installed tools and files across pauses. Daytona explicitly describes sandboxes as computers that can be snapshotted and split into parallel branches, while the Axomap landscape shows persistence becoming central across E2B and Blaxel as well as the cloud desktop products.

• Browser infrastructure is converging with identity infrastructure. An agent that appears as a new anonymous browser during every session will repeatedly lose authentication and trigger fraud controls. Web Bot Auth introduces cryptographic signatures that allow websites to identify supported agent traffic, while browser platforms are beginning to combine this identity with persistent profiles and protected credentials.

• Security is becoming the main production constraint rather than raw model capability. Agents process untrusted content from websites and repositories, creating exposure to indirect prompt injection. NIST’s recent red-teaming work found that such instructions can cause agents to exfiltrate data or execute malicious code, making isolation and tightly controlled network access core features of the runtime rather than optional enterprise add-ons.

How does the funding environment look?

• Funding has concentrated around companies trying to become foundational runtime platforms. Browserbase has raised at least $46.5 million across its stored seed and Series B rounds. E2B has disclosed $32 million in total funding, while Kernel has raised $22 million across its seed and Series A.

• The category has already produced several sizeable Series A rounds. Daytona raised $24 million after reporting a $1 million forward revenue run rate within three months and then doubling it six weeks later. The round was tied to a broader vision of giving each agent a programmable computer rather than only offering code execution.

• Capital is supporting several competing infrastructure abstractions at once. Investors have backed browser infrastructure through Browserbase and Kernel, general cloud sandboxes through E2B and Daytona, and younger products such as Blaxel and Lightpanda at the seed or pre-seed stage. This suggests that the market has not yet settled on whether the dominant primitive will be the browser, the sandbox or the complete virtual computer.

Agent Tool Access & Execution

What is this category about?

• The connection layer that allows an AI agent to use external software. An agent may know that a customer record needs updating, but it still needs a reliable way to authenticate with Salesforce and execute the correct action.

• The software must translate an agent’s intention into a valid operation. Instead of letting the model improvise an API request, the infrastructure presents clearly defined tools such as create_issue, send_message or update_contact, together with the parameters each action requires.

• Access and execution are closely linked. The agent must act with the permissions of the relevant user or organization without receiving unrestricted credentials. The infrastructure therefore manages authentication, determines which tools the agent may use and records what happened after each call.

• The category also extends tool access to software that has no usable API. In those cases, the infrastructure can turn a website into a machine readable tool, allowing an agent to log in and complete a workflow through the interface while still receiving structured inputs and outputs.

What do products in this category do?

• Integration platforms give developers one interface for accessing many software products. With Composio, a developer connects the user’s accounts once and gives the agent a set of approved tools. The agent can then search for the right action and execute it across products such as Gmail, GitHub or Salesforce without the developer maintaining a separate authentication and API integration for each one.

• Governed tool gateways focus on controlling how agents use those integrations inside a company. Metorial connects external tools through one managed layer, but ties each action to the identity and permissions of the person using the agent. This illustrates a more enterprise oriented approach: the product is not only making tools available, but giving administrators one place to decide which people and agents can use them.

• Website-to-tool infrastructure covers systems that do not expose a suitable API. Rindler maps a website into typed actions that an agent can call through MCP. Instead of repeatedly interpreting the page and guessing where to click, the agent receives stable operations while Rindler manages the browser session and adapts the mapping when the interface changes.

• Broader workspaces combine tool access with the context required to use those tools effectively. Wato gives an agent approved integrations alongside shared memory and reusable workflows. For example, an engineering agent can retrieve an incident playbook, inspect GitHub and Linear, and then save the result back into the company’s shared context through the same controlled workspace.

What types of customers are using these products?

• AI application companies use the infrastructure to add integrations without building them individually. Sales agent company 11x used Composio to add products including Outlook, Salesforce and Calendly. Composio reports that this avoided 380 hours of integration work and helped 11x support $4.2 million in enterprise contracts, although these figures come from the vendor’s own case study.

• Enterprise platform and security teams are the emerging customer for governed gateways. Metorial’s product is designed for organizations that need integrations to follow existing identities, group permissions and SSO policies. This becomes important when several departments use different agents but the company still needs one consistent access policy and audit trail.

• Portal heavy industries are a potential customer base for website-to-tool products. Rindler positions its infrastructure around workflows where agents need to operate insurance, healthcare, recruiting, commerce or government websites that lack reliable APIs. Public customer evidence remains limited, however, indicating that this approach is still at an earlier stage than conventional SaaS integrations.

What are the major trends shaping this category?

• MCP is becoming the common transport layer for agent tools. OpenAI’s Agents SDK now includes MCP among its standard agent primitives, while products across this landscape expose one MCP endpoint that can be used from several agent environments. This reduces the need for each infrastructure provider to build a proprietary connection method for every agent framework.

• The protocol is evolving from local tool connectivity into production infrastructure. The July 2026 MCP specification introduces a stateless core designed for ordinary HTTP infrastructure, long running task support and stronger authorization rules. These changes make it easier to operate remote tool servers at scale rather than treating MCP as a local developer convenience. 

• Tool infrastructure is expanding from connection into tool selection and execution planning. An agent connected to thousands of possible actions cannot load or evaluate all of them for every request. Products such as Composio’s Tool Router increasingly help the agent identify the relevant tools and maintain an execution session, moving the category closer to an operational runtime rather than a static connector catalog. 

How does the funding environment look?

• Composio accounts for nearly all publicly disclosed funding visible in this category. The company announced a $25 million Series A in July 2025, bringing its total funding to $29 million. Lightspeed led the round, with participation from several operators and investors connected to the developer-tool and agent ecosystem.

• The remaining companies are still at an earlier funding and commercialization stage. Their public signals are mainly product launches, YC participation and early hiring rather than large customer or capital milestones.

Agent Memory & Context

What is this category about?

• The infrastructure that allows an agent to build on what happened before. A model can use the messages included in its current prompt, but that context normally disappears when the session ends. A memory layer preserves useful information and makes it available when the agent encounters the same user, company or task again.

• Memory is not the same as storing every previous interaction. Complete histories quickly become too large, expensive and noisy to place inside every prompt. The system must decide what is worth retaining, combine repeated information and retrieve only the subset relevant to the agent’s current task.

• Agents need several kinds of memory at the same time. They may need to remember stable preferences, recent events, unresolved tasks and knowledge gathered from company systems. The infrastructure must keep these forms of context separate enough to retrieve them correctly while still presenting the agent with one coherent view.

• The underlying objective is continuity rather than recall alone. A useful agent should understand how information has changed and distinguish current facts from obsolete ones. This is why production memory systems increasingly include timestamps, decay, conflict resolution and provenance instead of functioning as simple vector databases.

What do products in this category do?

• Memory APIs extract durable information from conversations and return it when relevant. Mem0, for example, can identify a preference or personal fact in an interaction and store it against the relevant user. When the user returns, the application asks Mem0 for the memories related to the new request rather than sending the person’s entire conversation history back to the model. Mem0 also updates conflicting facts and uses signals such as recency and confidence to determine what should remain important.

• Connected memory products build context from the tools where work already happens. Hyperspell allows an application to connect a user’s Gmail, Slack, Notion and other accounts. It continuously indexes that material so an agent can retrieve information from the user’s broader workspace, not only from previous conversations with that particular agent.

• Context graphs preserve how people, facts and events relate and change over time. Zep converts conversations and business data into graphs associated with a user, organization or agent. If a customer changes jobs or a company updates its pricing, the system can retain both the historical fact and the period during which it was valid, then assemble the most relevant current context for the agent.

• Shared memory infrastructure lets context travel between different agents and interfaces. Zep’s MCP server, for example, allows a desktop assistant, a coding tool and a company-built agent to read and write to the same governed user graph. Something learned in one environment can therefore inform work completed in another rather than remaining trapped inside each application’s private memory.

What types of customers are using these products?

• AI companions and coaching products use memory to maintain long term relationships with users. Sunflower uses Mem0 behind an addiction recovery companion serving more than 80,000 people and processing over 20,000 messages per day. Instead of including the complete history in every prompt, it retrieves summaries of relevant goals, patterns and previous discussions. Mem0 reports that this reduced token usage by approximately 70–80%, although the figures come from its own case study.

• Education and personalization products need to remember how each user is progressing. A tutoring agent can retain which concepts a student struggles with, which explanations worked and what has already been covered. The memory becomes part of the product’s user model, enabling the agent to adapt over months rather than personalize only within one conversation.

• Enterprise agent platforms need context drawn from both conversations and operational data. Zep says an influx of large enterprise customers increased its usage thirtyfold in two weeks, from thousands to millions of hourly requests. These deployments require memory infrastructure that can serve many users and agents while keeping their graphs, permissions and data isolated.

• AI-native software companies use external memory infrastructure to avoid building retrieval and context management internally. Supermemory says its customers include products such as Cluely and Composio, with some customers sending billions of tokens each week. Its evolution from a consumer “second brain” into developer infrastructure illustrates how demand is shifting from people manually storing knowledge toward applications automatically building context about their users.

What are the major trends shaping this category?

• Larger context windows reduce some retrieval complexity but do not eliminate the need for memory. Gemini models can accept one million or more tokens, making it possible to provide far more information directly. However, Google still highlights the cost, latency and accuracy trade-offs of long prompts, particularly when several specific facts must be found. Memory infrastructure remains useful because it filters and compresses a much larger history before inference.

• Memory is moving from passive storage toward continuous synthesis. OpenAI’s updated ChatGPT memory system automatically consolidates information across conversations and prioritizes details according to relevance and freshness. The landscape shows the same movement at the infrastructure level through features such as memory decay, inferred-memory review and the automatic creation of higher-level observations.

• Memory is becoming independent from the application in which it was created. MCP gives servers a standard way to expose contextual resources to different clients, while companies such as Zep, Mem0, Hyperspell and Supermemory are building memory endpoints for multiple assistants and coding tools. This creates the possibility that users or companies maintain one context layer shared by many agents rather than reconstructing memory inside each product.

• Governance is becoming as important as retrieval quality. Persistent memory may contain years of personal conversations and sensitive company information. Products are therefore adding source provenance, access controls, retention policies, review queues and self-hosted deployment. OpenAI has similarly introduced memory sources and controls that show users which stored context contributed to a response and allow them to correct or remove it.

How does the funding environment look?

• Mem0 has attracted most of the disclosed capital in the category. The company raised $24 million across its seed and Series A rounds, including a Series A led by Basis Set Ventures. It also reported 41,000 GitHub stars, 14 million Python package downloads and growth from 35 million API calls in the first quarter of 2025 to 186 million in the third quarter, giving investors more evidence of developer adoption than is visible for most competitors.

• Supermemory represents the next funded cohort but remains much earlier. It announced a single $3 million pre-seed round led by Susa Ventures in October 2025. This confirms that the two Supermemory funding entries currently stored in Axomap refer to the same financing rather than separate $3 million and $2.6 million rounds.

• The investment thesis is broadening from “memory API” to context infrastructure. Mem0 is expanding into portable and local memory, Supermemory describes itself as a Context Cloud, and Zep has moved toward an enterprise Context Lake. The financing opportunity is increasingly framed around owning the layer that selects and governs everything an agent knows, rather than merely storing previous messages.