AIR’s researchers started with something that looked harmless: a useful AI skill.
They placed it inside a respected open-source ecosystem, where it inherited the credibility of roughly 37,000 GitHub stars, promoted it to ordinary users, and watched security scanners approve it. People installed it. Eventually, AIR says the experiment reached more than 26,000 AI agents.
The payload itself was deliberately benign. The real point was to test whether an apparently trustworthy skill could become a route into an agent’s private conversations and connected systems without triggering the protections users assumed were already there.
That experiment sits at the center of AIR’s argument.
By the time AIR stepped out of stealth, it had already secured $50 million to pursue the problem. Sequoia Capital led an initial $10 million seed round, and Greenoaks followed with another $40 million. Behind the company are CEO Yair Saban and CTO Niv Hoffman, two Unit 8200 veterans who came from offensive cybersecurity and are now applying that mindset to the increasingly complicated trust relationships around AI agents.
The company is betting that enterprise AI is quietly creating a new kind of software supply chain.
An agent becomes more useful by connecting to skills, plugins, MCP servers, sub-agents and external tools. Each addition can also introduce new code, permissions, dependencies and instructions. AIR argues that the risk is no longer limited to whether an add-on is safe when it is installed. The deeper question is whether it remains safe after the repository changes, a dependency is hijacked or an external instruction source is modified.
AIR’s own research offers a sharper example. In one investigation, the company identified 925 skills with hijackable dependencies affecting roughly 134,000 agents. The issue was not necessarily malicious code at the time of installation. It was that trust could persist even after the underlying dependency changed hands.
That is why AIR is building around continuous verification rather than one-time scanning.
Its platform is organized into four layers: AIR Control discovers and governs sanctioned and shadow agents; AIR Filter vets skills, plugins, MCPs and sub-agents before installation; AIR Defend monitors what agents do at runtime; and AIR Marketplace provides a managed source of pre-vetted add-ons.
Saban summarizes the philosophy in one sentence:
“An agent is only as safe as its context.”
That idea matters because AI agents do not operate in isolation. They continuously consume instructions, tools, websites, repositories and data. AIR wants to sit between the agent and those sources of trust, checking not only what something is today but what it may have become since the last approval.
Sequoia partner Bogomil Balkansky describes the same shift from another angle:
“This is not a scanning problem, it is a continuous re-verification problem.”
AIR says it already has more than 20 customers, with roughly a quarter described as large enterprises, and demand has been strongest in regulated industries such as financial services and pharmaceuticals. The company has around 40 employees, and the new capital will support further security research and go-to-market expansion across the United States and Europe.
For years, cybersecurity asked whether software was safe enough to install.
AI agents make the question harder because the thing you trusted yesterday may depend on something different tomorrow.
AIR’s $50 million bet is that enterprise security will have to move from approving AI tools once to continuously proving that everything an agent trusts still deserves that trust.