SAN FRANCISCO - Multiple cybersecurity startups have announced this week that they are withholding their products from the market, citing concerns that their technology is too powerful for responsible deployment. One of them, a two-person team called NullHorizon, hasn't written any code yet. "We've scoped the architecture and the implications are severe," said co-founder Derek Lau. "Shipping would be irresponsible. We haven't built it yet, but when we do, we won't be releasing it."

The trend started on Tuesday, when Anthropic announced it was withholding Mythos, its most powerful model, from general availability after it autonomously discovered thousands of zero-day vulnerabilities. The announcement generated more coverage than most product launches. Investors noticed. "We used to look for product-market fit," a partner at Thornfield Ventures told The Exploit. "Now we're looking for product-market threat. If you can ship, you're probably not doing anything interesting."

On Thursday, Thornfield led an $85M Series B for Kova Labs, a seven-person startup building agentic exploit generation. The round valued Kova at $620M. It has no customers. Its founders describe the platform as "too effective to responsibly make available." Inbound tripled the day they announced they had nothing to sell.

By Wednesday morning, Spectra Defend ($180M raised across three rounds) announced it was "temporarily withholding" its cloud attack surface tool after an internal red team exercise produced results that were, per CEO Nadia Chen, "frankly terrifying." She declined to elaborate on the results, the methodology, or the team that conducted them. "We owe it to the community to be cautious," she told CyberWire in an interview that also, coincidentally, confirmed their Series D was open at a target valuation of $1.4B.

The most recent YC batch includes four companies in various stages of strategic non-release. Three have functioning prototypes. NullHorizon is the fourth. Lau says the company is "withholding out of an abundance of caution," though when pressed on what exactly is being withheld, he referred The Exploit to a forthcoming blog post that is also being withheld.