Closing the AI security gap as advanced new frontier models and coding agents expand the enterprise attack surface.
We are pleased to announce that Palo Alto Networks has officially completed the acquisition of Koi.
With the transaction closed, we are moving from vision to reality, integrating Koi’s pioneering Agentic Endpoint Security directly into the fabric of the Palo Alto Networks product portfolio. By integrating Koi’s technology with Prisma® AIRS™, Palo Alto Networks will extend visibility and security to agentic AI that is localized to the endpoint, offering a single control plane to secure enterprise-wide AI adoption. In addition, this acquisition enables Palo Alto Networks to introduce a new module for Cortex XDR® to identify and remediate risks within the unmanaged AI software ecosystem. Koi’s capabilities will also remain available as a standalone offering, allowing every customer to benefit from industry-leading agentic endpoint security capabilities alongside their existing EDR solutions.
By closing this acquisition, we are delivering the industry’s most comprehensive security lifecycle for the agentic enterprise, enabling our customers to embrace the future of AI without compromise.
Modern endpoints are no longer defined by executables alone. Increasingly, endpoint behavior is shaped by nonbinary software, such as code packages, browser extensions, IDE plugins, scripts, local servers (including MCP), containers and model artifacts. They are installed directly by employees and developers without centralized oversight. Because these components are not classic binaries, they often fall outside the visibility and control of traditional endpoint security tooling.
AI agents compound this problem. They are legitimate tools that operate with the user’s credentials and permissions, enabling them to read, write and move data, taking privileged actions across systems. When compromised or misused, agents become the ultimate insider. They can autonomously discover, invoke and even install additional components at machine speed, accelerating risk across an already expanding and largely unmanaged software layer.
Weaponizing Trusted Automation
This is not a future concern. The recent viral emergence of OpenClaw serves as a cautionary tale for the agentic era. Developed by a single individual in just one week, it rapidly secured millions of downloads while gaining broad permissions across users' emails, file systems and shells. Within days, researchers identified more than 135,000 exposed OpenClaw instances and more than 800 malicious skills in its marketplace, underscoring how a single unvetted agent can create an immediate, global attack surface.
OpenClaw is not an outlier. Recent research highlights how quickly this risk is materializing:
- Vibe Coding Threats: AI extensions in versus code were found leaking code from 1.5 million developers. This tool could read any open file and send it back to the developer, collect mass files without user interaction, and track users with commercial analytics SDKs.
- Malicious MCP Server: Koi documented the first malicious Model Context Protocol (MCP) server in the wild. When developers added a specific skill to their AI tools, the MCP silently forwarded every email to the plugin creator. What’s more, this capability was added after developers had already started using it.
Compounding this risk is the fact that autonomous agent actions are often difficult to trace or reconstruct, leaving Security Operations Centers (SOCs) without the visibility they need when an incident occurs.
A New Category of Protection
Complete endpoint security for the rapidly expanding risk of agentic AI calls for a new category of protection: Agentic Endpoint Security. That’s why we acquired Koi, a pioneer in this space. Koi is designed to eliminate blind spots across the AI-native ecosystem and help organizations govern agentic tools safely.
Its technology rests on three core pillars:
- See All AI Software – Gain complete visibility into the AI tools, agents and nonbinary software running in your environment.
- Understand Risks – Continuously analyze and understand the intent and risk level of all software and AI agents.
- Control the AI Ecosystem – Enforce policy in real-time to remediate issues and block risky behaviors.
Securing the Agentic Enterprise
We have conviction that Agentic Endpoint Security will soon become a standard requirement for enterprise security. Now that the acquisition has closed, we intend to integrate Koi’s capabilities across our platforms to help our customers secure the AI-native workspace.
The wave of AI agents approaching the enterprise cannot be held back. Instead, we must offer secure tools that enable companies to confidently embrace agentic innovation.
Forward-Looking Statements
This blog post contains forward-looking statements that involve risks, uncertainties, and assumptions, including, but not limited to, statements regarding the anticipated benefits and impact of the acquisition on Palo Alto Networks and its customers. There are a significant number of factors that could cause actual results to differ materially from statements made in this blog post, including, but not limited to: risks related to disruption of management time from ongoing business operations due to the acquisition and the integration of Koi and other recently acquired companies; our ability to effectively operate Koi's operations and business, integrate Koi's business and products into our products, and realize the anticipated synergies in the transaction in a timely manner or at all; changes in the fair value of our contingent consideration liability associated with acquisitions; developments and changes in general market, political, economic and business conditions; failure of our platformization product offerings; risks associated with managing our growth; risks associated with new product, subscription and support offerings; shifts in priorities or delays in the development or release of new product or subscription or other offerings or the failure to timely develop and achieve market acceptance of new products and subscriptions, as well as existing products, subscriptions and support offerings; failure of our product offerings or business strategies in general; defects, errors, or vulnerabilities in our products, subscriptions or support offerings; our customers' purchasing decisions and the length of sales cycles; our ability to attract and retain new customers; developments and changes in general market, political, economic, and business conditions; our competition, including increased competition from entry into new product categories; our ability to acquire and integrate other companies, products, or technologies in a successful and timely manner; our share repurchase program, which may not be fully consummated or enhance shareholder value, and any share repurchases which could affect the price of our common stock; and our debt repayment obligations.
Additional risks and uncertainties that could affect our financial results are included under the captions "Risk Factors" and "Management's Discussion and Analysis of Financial Condition and Results of Operations" in our Quarterly Report on Form 10-Q filed with the SEC on February 18, 2026, which is available on our website at investors.paloaltonetworks.com and on the SEC's website at www.sec.gov. Additional information, risks and uncertainties will also be set forth in other filings that we make with the SEC from time to time. All forward-looking statements in this blog post are based on information available to us as of the date hereof, and we do not assume any obligation to update the forward-looking statements provided to reflect events that occur or circumstances that exist after the date on which they were made.