doxx.net Is Building a Private Network for AI Agents
You ask an AI agent to book a flight, download a contract and log in to your company’s billing system. It does all three. On the way, your request passes through a browser service, a DNS lookup, a few cloud servers, the airline’s site and whatever tools the agent called. When people browse, some of them use a VPN. When an agent browses for you, who is watching, and who could change what it sees?
On 1 October the company announced a $38 million Series A led by Andreessen Horowitz (a16z), with Animo Ventures and Focal.vc joining, to build a private network for AI agents and the people who use them, running alongside the public internet. a16z partner Joel de la Garza joins its board, according to the company’s release. We gave it three paragraphs in our October funding roundup; this piece explains what it is actually building.
What Do Agent, VPN and DNS Mean Here?
Most of this story is plumbing. These are the terms that matter, in plain words.
Ten terms in plain words
| Term | What it means |
|---|---|
| AI agent | An AI that does tasks in steps for you: opens pages, fills in forms, downloads files, calls other tools. |
| VPN | An encrypted tunnel from your device to a VPN company’s server. Your network can’t see inside it, but the VPN company can see where the traffic goes next. |
| Private network | A network only its members can reach, usually built from encrypted links that may still run over the ordinary internet’s cables. |
| Peer-to-peer | Data goes from your device to the other device without being stored on a central server. If a direct link can’t be made, it may be relayed, still encrypted. |
| Backbone | The long-distance, high-capacity links that carry traffic between cities and countries. |
| DNS | The internet’s phone book: it turns a name like example.com into the address a machine can reach. |
| DNS root | The top of the naming tree, which decides which endings, such as .com, exist at all. |
| Certificate authority | An organisation that issues the digital ID cards websites show, which your browser checks to confirm it is talking to whoever controls that name. |
| MCP | Model Context Protocol, an open standard for connecting AI models to outside tools and data: a universal plug for agents. |
| DDoS | An attack that floods a site with junk traffic from many machines at once until it falls over. |
Is It Safe When an AI Agent Uses the Internet for You?
Safe enough for many tasks, if you limit what the agent can touch. The harder part is seeing who sits in the middle. Agents now book, download and log in for people, and every task adds services between you and the result: the model provider, the browser it drives, the tools it calls through MCP, the sites it visits. Each of those can see something, and some could alter what comes back.
By Imperva’s count, automated traffic is now most of the web. Its 2026 Bad Bot Report says bots account “for over 53% of all web traffic, with 40% classified as malicious”, measured across its own customers’ sites. Agents acting for real people now share the road with that. The OWASP Top 10 for Agentic Applications, published in December 2025, lists the risks security teams worry about, from agents misusing tools to agents being tricked by what they read.
A VPN solves part of this. It hides your traffic from the café Wi-Fi or your internet provider, but the US Federal Trade Commission warned in 2018 that it moves your trust from those networks to the VPN provider. After the VPN server, your traffic is back on the public internet, with its public DNS and certificate system. a16z’s podcast with the founder sums up his view as traditional VPNs solving only part of the problem.
What Is doxx.net’s Private Network for AI Agents?
According to the company and a16z’s announcement, doxx.net is “a parallel, private network” that a16z says covers private browsing, direct file transfer, encrypted links between devices and agents, and peer-to-peer calls and messages. a16z writes that “calls, messages, and file transfers travel directly between peers without a central communications server in the middle.” The company says it ran a closed beta from December 2025, during which it blocked more than 38 million threats, and it launched an open beta with the funding.
It builds an unusual amount itself. The company and a16z say it runs its own global backbone and hardware, its own IP address space, its own DNS root and its own certificate authority, with 196 custom top-level domains, and a16z says users can create domains that resolve only inside the network. It says its AI runs on its own local models and bare-metal servers, and that accounts need no username, password, email or phone number; they are created through proof-of-work, a small computing puzzle your device solves instead of handing over an identity. It makes mass fake sign-ups costly; it does not hide your IP address, and paid plans still need a way to pay.
How does agentic defined networking (ADN) work?
ADN is the company’s name for letting agents run the network. Through what the release calls “a full network API with native MCP support”, a16z says an agent can connect devices, set firewall rules and open private connections under the user’s rules. Barrett Lyon, the founder and CEO, put it as a question in the release: “Have you ever had your agents configure your network, lease public IP addresses, and set up your security policy” with “no one in the middle?” Network World reports that administrators give each agent a read-only or admin token, and that tokens can expire or be revoked.
Five Ways to Read the doxx.net Bet
Technical: running your own DNS and certificate authority
Running a private DNS root and certificate authority is not hard in itself; getting devices to trust them, and guarding the keys, is. On the public internet, those two systems decide which address a name points to and which certificates prove control of a name. Owning both lets doxx.net vouch for every name and certificate inside its network. It also makes the company the single authority for both, and that cuts both ways: a root certificate your device trusts can, unless it is technically limited to doxx.net’s own domains, vouch for any website, including your bank’s. The public material does not say whether its certificate authority is limited that way. Network-only domains are useful for private services an agent needs to reach, such as a home server or an internal tool, but nobody outside the network can reach them, and a browser will only trust its certificates if your device is set to trust doxx.net’s root, usually by installing its app or a profile. Some apps will still refuse.
Peer-to-peer delivery means a call or file does not sit on a central server where it could be stored or read. That is how Tailscale builds its private networks too. The difference is that doxx.net also wants to run the network underneath, the naming and the certificates. Encryption hides what a call says, but whoever carries the packets can still see who talked to whom, and when.
Agents: convenience versus permission
Letting an agent change firewall rules saves time. It also hands network power to software that can be misled by a web page. The token model Network World describes is the right shape: separate read and admin rights, expiry, revocation. What the public material does not show is how fine-grained those permissions are, or what record is kept when an agent changes something. MCP support matters for reach, since MCP is now governed by the Linux Foundation’s Agentic AI Foundation after Anthropic donated it in December 2025, and many major agent tools now support it. We looked at the wider question of agents going wrong in our piece on NVIDIA OpenShell and agent safety.
Privacy: less data handed over, more trust in one company
No email, no phone number and AI on the company’s own servers mean less personal data sitting with third parties, if the claims hold, though payments and app-store downloads can still tie an account to a person. Lyon’s pitch in the release is that “the industry sells privacy as a feature while routing your traffic through rented infrastructure”. But when one company runs the backbone, the names, the certificates and the AI, you are trusting it with all of them at once. None of this has been independently audited in public yet.
Founder and capital: why a DDoS veteran matters
Lyon founded Prolexic, which the release credits with pioneering DDoS defence and which Akamai agreed to buy for about $370 million in December 2013, according to SecurityWeek. He later started BitGravity, XDN and Defense.net, bought by Tata Communications, Fortinet and F5. Running a global network under constant attack is exactly the skill a parallel network needs, which makes the idea more credible than it would be from a first-time founder. a16z frames the bet around trust: “Gone are the days where you had to rely on a sketchy VPN provider in an unknown country of origin.”
Business: who has to move?
VPNs are a crowded consumer market, and companies already have zero-trust products from Cloudflare and others. A parallel network only gets more useful as more people and services join it, so doxx.net has to persuade both sides at once. Pricing is public: its pricing page lists a free plan for three devices, Essentials at $6 a month and Pro at $16 a month. The company says it has apps for iOS, macOS and Android, with Windows and Linux support; its download page currently links only the iOS app. It has not disclosed customers, user numbers or its valuation.
Three Tips Before You Let an Agent Online
- Give agents the smallest permission that works. Read-only first, separate accounts from your own, and no payment or admin rights unless you are watching the task.
- Map where the data goes. List every service an agent touches for a task (model provider, browser service, tools, network) and what each one can see.
- Price in the vendor. A provider that runs your names, certificates and connections is hard to leave. Ask how you would export them, and what happens if the company changes hands.
For businesses, this is the same review we run when clients connect agents to internal systems, under IT infrastructure and AI agent development.
Three Questions to Ask Agent Network Companies
- Who is using it? No customers or user numbers are public. A network is only as useful as the people and services on it.
- Where does the money come from? Paid plans start at $6 a month, above a free tier for three devices. Whether businesses pay more, and for what, is not public yet.
- Where do network effects start? Network-only domains are a reason to join only if services you need live there. Watch for the first ones that do.
VPNs are not going away. doxx.net has an open beta, a founder who has run networks under attack, and a16z’s money. It has not yet shown customers, an independent audit or services that live only on its network; those are the things to watch. When agents use the internet for us, would you rather trust the public network, or one company’s private one?
Further reading keywords: “agentic defined networking”, “Model Context Protocol security”, “OWASP Top 10 for Agentic Applications”, “peer-to-peer mesh VPN”, “DNS root and certificate authority”.
FAQ: doxx.net and AI Agent Networks
What is doxx.net?
doxx.net is a US company, reported to be based in Miami, building a private network for AI agents and the people who use them, running alongside the public internet. The company says it covers private browsing, file transfer, encrypted connections between devices and agents, and peer-to-peer calls and messages. It announced a $38 million Series A led by Andreessen Horowitz (a16z) on 1 October 2026 and launched an open beta.
What is agentic defined networking (ADN)?
It is doxx.net’s name for letting AI agents set up network connections themselves, inside rules the user sets. Through the company’s network API, which supports MCP, an agent can connect devices, set firewall rules and open private connections. Network World reports that each agent gets a read-only or admin token that can expire or be revoked.
How is doxx.net different from a VPN?
A VPN wraps your traffic in an encrypted tunnel to the VPN company’s server, and from there it goes out onto the public internet. doxx.net says it runs a separate network with its own backbone, IP addresses, DNS and certificate authority, sends calls, messages and files directly between devices, and lets users register domains that only work inside that network. Both still ask you to trust the company running them.
Is it safe to let an AI agent browse the internet for me?
It can be, with limits. Give the agent only the accounts and permissions the task needs, prefer read-only access, keep it away from payment and admin rights unless you are watching, and check which companies see its traffic. OWASP now publishes a top 10 list of risks for agentic applications, a useful checklist before you connect an agent to real systems.
How much does doxx.net cost?
At the time of writing, its pricing page lists a free plan for three devices, Essentials at $6 a month and Pro at $16 a month, during an open beta. The company has not disclosed its valuation, customers or user numbers.
