AIR Raises $50M to Continuously Vet AI Agent Skills and Add-Ons

Enterprise AI deployments are accumulating a new attack surface most security teams aren't watching: the skills, plugins, MCP servers, and third-party add-ons that autonomous agents load at runtime to interact with external systems. AIR, founded by Unit 8200 veterans Yair Saban (CEO) and Niv Hoffman (CTO), emerged from stealth on September 1 with $50 million raised across two seed rounds to build continuous vetting infrastructure for exactly that layer. For engineers deploying agentic workflows at scale, this is a supply chain integrity problem with direct analogues to the unsigned-driver era of early 2000s operating systems.

The funding came in two tranches that closed within weeks of each other: a $10 million first seed led by Sequoia, and a $40 million second seed led by Greenoaks. Participants include Swish, Netz, and angels Zach Frankel (president of Cognition), Yinon Costica (co-founder of Wiz), Ofir Erlich (co-founder of Eon), Varun Anand (co-founder of Clay), Anne Neuberger, and Omer Adam. The company employs around 40 people and will direct the capital toward research hiring and go-to-market expansion across the U.S. and Europe.

The Attack Vector AIR Is Designed to Close

Saban's framing is precise: agents increasingly operate like operating systems, pulling in external components to extend their capabilities, yet those components carry none of the signing or provenance guarantees that modern OS kernels demand from drivers. The threat model isn't direct agent compromise — it's content poisoning, where an attacker corrupts what an agent consumes rather than the agent itself. As autonomy becomes the default configuration in agentic deployments, the blast radius of a single compromised skill or MCP server expands proportionally, since the agent may act on tainted content across databases and enterprise systems before any human reviews its outputs.

AIR's approach operates at three layers. First, a discovery component maps all agents active inside a company's environment, including shadow usage — employees running unapproved AI tools or authenticating with personal accounts. Second, an enforcement layer hooks into agent runtimes to intercept and inspect actions such as loading a skill or fetching remote content before execution proceeds. Third, every tool or add-on an agent attempts to use is checked against a whitelist that AIR maintains and continuously updates. The whitelist isn't static: AIR monitors publicly available skills and add-ons for behavioral changes, because a previously approved package can become malicious if a dependency it fetches is modified or if the developer's account is taken over — a threat pattern already observed with AI coding agent credential exposure.

AIR's current filtering rate is a concrete indicator of ecosystem quality: the platform rejects approximately 27% of the skills and add-ons it finds available online. Sequoia partner Bogomil Balkansky described the core challenge as "a continuous re-verification problem" rather than a scanning problem — every skill, plugin, MCP server, and sub-agent must be re-inspected each time it changes, in real time, across an entire company's agent fleet. A static scanner cannot replicate a year of accumulated behavioral baselines across a living ecosystem.

Competitive Positioning

AIR enters a market with established and well-capitalized competitors. Noma Security offers discovery, access controls, and runtime monitoring for agents, MCP servers, and skills. Zenity provides security and governance tooling with comparable scope and closed a $125 million Series C in August. Astrix Security's identity platform covers agent and MCP server discovery and control. Operant AI offers agent protections alongside an MCP gateway. Noma itself raised a $100 million Series B last year.

AIR's answer to the crowded field is that endpoint visibility is a commodity — Saban said explicitly that gaining visibility over the endpoint is "easy" and "everybody's going to do it" — while continuously vetting the skills and plugin ecosystem is the defensible work. He also acknowledged that AI labs will eventually build native security controls, but argues enterprises will still require vendor-agnostic enforcement that operates consistently across providers and agent frameworks. AIR currently counts more than 20 customers, roughly a quarter of which are large enterprises, with the heaviest early demand from financial services and pharmaceutical firms.

The $50 million raise is a modest opening position against competitors carrying nine-figure war chests, but Balkansky's framing — infrastructure problem first, security problem second — suggests investors believe the window for building the canonical vetting pipeline is still open. For enterprise security teams navigating multi-agent control boundaries, AIR's runtime interception model is one of the first architectures designed to treat the tool-use layer as a first-class security perimeter rather than an afterthought bolted onto agent orchestration.