Dean Valentine and the trouble with a passing grade

Dean Valentine sells a product built on artificial intelligence, which makes him an interesting person to hear asking for better proof of what artificial intelligence can do. A founder has every reason to enjoy a rising graph. Customers, unfortunately, cannot deploy a graph. They have software to ship, defects to understand, and colleagues who would prefer their next security notification to contain something useful.

At ZeroPath, where Valentine is co-founder and CEO, that last requirement organizes the work. The company looks for vulnerabilities in software, checks its findings, and prepares fixes. Each step asks a less glamorous question than the preceding one. Finding something suspicious is a beginning. Establishing whether it matters takes more effort. Giving a developer a change worth reviewing is where the bill for all that intelligence finally comes due.

His public career offers a view of a founder moving toward that bill: security credentials, a trading-infrastructure business, an acquisition, another company, and increasingly pointed arguments about evidence. The interesting tension is between his commercial confidence in AI and his impatience with the ways its progress gets advertised. He has committed himself to making the technology useful. That gives him reasons to examine it closely.

A different kind of early credential

Valentine’s professional record includes an OSCP certification from February 2018 and an OSCE from August 2020, both issued by Offensive Security. These credentials place security practice early in his career, well before ZeroPath’s founding. The dates give his later interest in automated vulnerability discovery a history. He arrived at AI security with an existing connection to the craft of testing systems.

There is another early chapter, less tidily arranged. In an AI Safety Founders conversation, he discussed leaving college and moving to Bangalore. It is a geographical detail that cuts through the familiar San Francisco founder biography. His route involved a departure and a move across the world before the company now attached to his name. The conversation frames those decisions alongside his eventual work on AI code scanning.

Those choices matter without requiring a romantic explanation. Leaving an institution does not automatically produce insight, and crossing an ocean does not confer judgment. What the early chapters provide is movement: a young security practitioner taking a route that would eventually include both technical work and company building. The later CEO cannot be understood entirely through the job title.

The co-founder who came along again

Before ZeroPath, Valentine co-founded Mevlink with Etienne Lunetta. Its business involved low-latency trading data for decentralized finance. In 2023, bloXroute Labs acquired it. By 2024, Valentine and Lunetta were building together again, this time in application security. A different customer problem, a different product, and a familiar working relationship came into the same room.

That continuity is a concrete part of his story. Startups are often narrated around one individual, as though a company were a personal essay with payroll. Here, the earlier partnership survives the change in subject. Lunetta became ZeroPath’s co-founder and COO. Valentine became its CEO. Their previous business supplied a shared history before the new one had much history of its own.

The founding group also included Raphael Karger and Nathan Hrncirik. Karger’s background included Google security engineering and Bishop Fox consulting; Hrncirik brought Tesla red-team experience. ZeroPath entered Y Combinator’s Summer 2024 batch. The team brought together people with experience of building companies and people with experience of finding where software could fail. Valentine’s task was now to help make a business out of that combination.

The grade and the work

In March 2025, Valentine published an essay about recent AI model progress. He described an early improvement after adopting Claude 3.5 Sonnet, followed by newer releases that had brought little comparable benefit in his team’s evaluations. He also admitted hesitating to say so publicly, worrying that the disappointing results might make his own team look bad.

That admission gives the argument some personal weight. A founder questioning a supplier’s progress also invites questions about his own implementation. Valentine accepted that exposure. His position was grounded in the work his company needed models to perform, rather than a blanket dismissal of AI. The distinction matters: ZeroPath’s existence depended on the belief that useful capability was already available.

The public discussion travelled beyond a company blog. A startup spotlight hosted by Finn Metz invited Valentine to discuss the gap between benchmark progress and useful capability, as well as building a business with both safety impact and commercial success. Those topics describe the awkward territory he occupied. An entrepreneur needed the technology to work; a security practitioner needed a reason to trust the result.

For a buyer, the argument has a plain appeal. A test score can help compare systems, but the thing being purchased still has to survive the assignment. A beautifully written vulnerability report is particularly expensive if someone must spend an afternoon discovering that its premise is wrong. Security gives fluent prose a demanding audience. The audience would like to know whether the door actually opens.

The customers who read every line

In autumn 2025, ZeroPath’s work reached a revealing audience: the maintainers of curl. Security researcher Joshua Rogers used the tool and forwarded potential issues to the project. Daniel Stenberg described receiving findings that helped the maintainers identify defects, while also recording that some were rejected or considered too minor to change. The reception was constructive, and it involved judgment.

That is a useful scene in Valentine’s company story because it preserves the people doing the checking. The tool produced candidates. A researcher brought them forward. Maintainers worked through them and decided what belonged in their code. There was no need to imagine a CEO personally discovering every flaw. The achievement depended on a chain of technical work and human decisions.

ZeroPath later reported 170 verified issues in curl. Its examples included logic errors, protocol-compliance problems, and memory leaks. These were varied software defects, with different consequences; the number should be read as a count of issues rather than a count of equally severe security emergencies. The company’s account put practical results behind its argument for analyzing how code behaves.

For Valentine, this kind of result gives the business a specific object to point at. Code was examined. Reports were considered. Fixes followed. The work has enough ordinary texture to resist becoming a miracle story. Ordinary texture is helpful here. Software maintenance contains disagreement, prioritization, and small corrections, all of which are harder to put on a victory slide than a large number.

Three minutes, then the questions

In February 2026, ZeroPath was named one of the ten finalists in the RSAC Innovation Sandbox. The competition gave each finalist a three-minute pitch followed by questions. It was external recognition for a company founded in 2024, and a compact version of the challenge facing Valentine: explain the product quickly enough to earn attention, then make the explanation withstand scrutiny.

He also announced that ZeroPath had raised a total of $12.5 million, thanking backers including HOF Capital, SurgePoint Capital, Crosspoint Capital Partners, Paul Graham, and Y Combinator. His announcement emphasized flaws arising from service interactions, authentication, and logic across repositories. Funding gave the team resources; the technical claim still required customers to examine what the system found.

On Product Hunt, Valentine offered a more prosaic description of the workflow. A user installs the GitHub application, selects repositories, and receives alerts and patches through pull-request checks. It is an appealingly short route from a founder’s argument to a developer’s working day. The eventual audience for the pitch includes someone looking at a proposed change and deciding whether it deserves to be merged.

The test that hopes to fail

In July 2026, Valentine introduced CatastropheBench, an open-source test of autonomous vulnerability discovery. It gives an agent current software and its source code, without a known flaw or an internet connection to supply clues. The question is whether the agent can reach remote code execution. The result must be demonstrated, rather than awarded for a persuasive explanation.

“CatastropheBench removes the answer key.”Dean Valentine · July 2026

The desired score is zero. A successful exploit would create a disclosure problem, with the affected vendor contacted before public release of the result. That design adds a different purpose to Valentine’s work on measurement. His company wants better detection for defenders. This test asks when an autonomous agent’s ability to discover a dangerous flaw should interrupt a release.

In the company’s published initial run, the tested agents achieved no qualifying remote code execution across the target variants. That outcome is bounded by the setups and tasks used. It offers a result to inspect, rather than permission to generalize about every model or every piece of software. A zero on one instrument has a specific meaning, just as a high score on another does.

The personal thread is now fairly clear. Valentine’s career has moved through security practice, company building, and a sustained argument about what counts as evidence. He has a business to grow and a technology to improve. Both obligations make the same demand when a system claims to have done something useful: show the work. The passing grade can wait its turn.