AIR Raises $50M to Vet AI Agent Skills: What It Means
On 1 September TechCrunch reported that AIR, founded by Unit 8200 veterans Yair Saban and Niv Hoffman, raised $50 million across two seed rounds — $10M led by Sequoia, then $40M led by Greenoaks — to discover the AI agents running inside companies and continuously vet the skills, tools and add-ons those agents use. Here is why that matters if you run agents, and what to do about it this month.
- Published
Primary source: TechCrunch, 1 Sept 2026. Figures below are as reported there; our analysis follows.
What was announced
| Item | Detail |
|---|---|
| Raised | $50M across two seed rounds ($10M, then $40M) |
| Leads | Sequoia (first round), Greenoaks Capital (second) |
| Founders | Yair Saban (CEO), Niv Hoffman (CTO) |
| Product | Discovers agents in the enterprise; vets skills, tools and add-ons; blocks unapproved behaviour; marketplace of vetted add-ons |
| Traction | 20+ customers, ~25% large enterprises; strongest demand in financial services and pharma |
| Claim | Filters roughly 27% of the add-ons and skills it finds online |
| Use of funds | Hiring researchers; go-to-market in the U.S. and Europe |
Why this is a category now
Agents do not just answer — they install capabilities. A "skill" or plug-in is code and instructions the agent will follow, and, as AIR’s founders put it to TechCrunch, attackers can poison the content an agent consumes instead of attacking it directly. The number that should worry every CTO is the 27%: roughly one in four add-ons AIR finds fails its checks. If your agents can pull tools from the open internet, a quarter of what they might pull is suspect.
- Every tool an agent can call is part of your attack surface. Descriptions, not just code — a tool description can carry an injection.
- Regulated industries are buying first because their auditors are asking the question; everyone else’s auditors will ask next year.
- A whitelist beats detection. AIR’s model — vet, then allow — is the right shape whether you buy it or build it.
How to get 80% of this without a vendor
- Inventory: list every agent in the company and every tool, MCP server or skill each one can reach. Most teams cannot do this today; it takes a day and is the whole foundation.
- Allow-list: agents may only load tools from a repository you control. No fetching skills from the open web at runtime.
- Review gate: a new tool or skill goes through the same review as a dependency — who wrote it, what it can do, what it sends where.
- Scoped credentials: each agent gets the minimum access its job needs, per environment, never a shared admin token.
- Trace everything: every tool call logged with arguments. This is also what makes evals and incident response possible.
We build these controls into every agent we ship and retrofit them onto agents other teams built. If your agents are in production and nobody can answer "what tools can they call?", that is the first engagement to run.
Frequently asked questions
Should we buy an agent security product?
If you run agents in a regulated industry with a large tool surface, evaluate one. For most businesses running a handful of agents, an inventory, an allow-list and scoped credentials get most of the risk down at a fraction of the cost.
Does this apply to MCP servers?
Directly. An MCP server is a set of tools an agent will trust; vet it like a dependency and scope its credentials.
What is the single most common gap you see?
Agents allowed to fetch tools or instructions from the web at runtime. Close that and you remove the class of attack AIR is built around.
