The Pentagon is running Twenty's AI against live targets
Forbes puts named contracts on a $1.2 billion startup whose only customer is the Pentagon and whose software runs offensive cyber campaigns hundreds at a time.
Forbes puts named contracts on a $1.2 billion startup whose only customer is the Pentagon and whose software runs offensive cyber campaigns hundreds at a time.
The Pentagon is using the AI software of the startup Twenty to run offensive hacking campaigns, Forbes reported. The software automates the gruntwork: identifying targets, running reconnaissance, and deciding what to do once a target is compromised.
Chief executive Joe Lin said a campaign against a single target used to take months or years. "We're going from current processes that are highly artisanal to ones that can scale out industrially, where you're able to simultaneously prosecute hundreds of targets versus one at a time," he told Forbes.
The contracts behind that work are small in public view. Twenty's only customer is the Pentagon, and public records show a handful of deals. The most recent, signed in December with the Air Force Office of Special Investigations, is worth up to $640,000 and supplies cyber tools aimed at state-sponsored hackers. A U.S. Cyber Command deal Forbes reported last year runs to $12.6 million. The company declined to provide complete revenue figures, and classified work does not surface in the public record.
Khosla Ventures put an additional $30 million in at a $1.2 billion valuation, the company said, about a month after a $100 million Accel-led Series B. Total raised is $168 million. Partner Jon Chu led the deal after Lin spent roughly 90 minutes pitching him and Vinod Khosla in San Francisco.
Twenty pairs frontier AI models with human operators and will not say which models it uses. The Department of War is not currently buying from Anthropic after the White House declared the company a supply-chain risk, a designation Anthropic has challenged in court. Pentagon cyber work could still reach those models through Twenty. Khosla said he disagreed with Anthropic's position in that fight and urged the U.S. to invest in autonomous AI weapons. His firm's stake in OpenAI gives Twenty a second set of ties.
Lin said Twenty does not use the models to research and exploit vulnerabilities, even though systems like Anthropic's Mythos can.
The battlefield and the startup story — free in your inbox every week. No paywall.
Subscribe Free →Adm. Dennis Velez, chief of staff at U.S. Cyber Command until his retirement last month, expects imitators. "I think we're just starting to scratch the surface of what's possible," he told Forbes. For now a $1.2 billion valuation sits on $13.2 million of publicly visible contracts.
Frequently Asked Questions
What does Twenty's software actually do?
It uses AI to run many hacking campaigns at once, automating target identification, reconnaissance and post-compromise decisions, according to Forbes. CEO Joe Lin told Forbes a campaign against a single target previously took months or years.
Who buys it?
The Pentagon is Twenty's only customer, per Forbes. Public records show a December contract with the Air Force Office of Special Investigations worth up to $640,000, and a U.S. Cyber Command deal worth up to $12.6 million that Forbes reported last year. Classified work is not public.
How much has Twenty raised?
$168 million in total, after Khosla Ventures added $30 million at a $1.2 billion valuation, according to the company's announcement. That follows a $100 million Accel-led Series B at a $1 billion valuation about a month earlier.
Which AI models does Twenty use?
Twenty combines frontier AI models with human hacking and cyber-intelligence expertise but will not specify which ones, per Forbes. Lin said the firm uses whatever commercially available model suits a task, plus any its military and intelligence customers already operate.
What is the Anthropic connection?
Forbes reported the Department of War is not currently buying from Anthropic after the White House declared it a supply-chain risk, a matter Anthropic has taken to court, but Pentagon cyber efforts could still benefit from Anthropic's models indirectly through Twenty. Vinod Khosla publicly disagreed with Anthropic's stance in that dispute.
Does Twenty use AI to find vulnerabilities?
Lin said it does not use the models to research and exploit vulnerabilities, even though models such as Anthropic's Mythos are capable of it, according to Forbes.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
Marcus Schuler
Marcus Schuler edits BattlePolicy, a daily defense-technology brief connecting the companies and capabilities behind modern war to the contest among Europe, the US, Russia, and China.