AI Agent Security Draws $50M as AIR Exits Stealth

Six months after two former military cyber operators founded the company, AIR left stealth with a $50 million round led by Sequoia Capital and Greenoaks. Swish Ventures and Netz joined, with private investors drawn from the cybersecurity and AI industries.

The speed of that raise will get the attention. However, the more useful detail for founders is the problem AIR picked, because most small teams already have it. Companies are handing autonomous agents access to live systems faster than they are writing rules for them.

Six Months From Founding to Fifty Million

Yair Saban and Niv Hoffman started AIR in February 2026. The two met roughly a decade ago during military service, and they bring backgrounds in offensive cybersecurity, enterprise infrastructure and AI security research.

That pairing explains the check size. Investors were not buying a thesis about agents. They were buying two people who have spent years breaking systems for a living, which follows the same pattern as other recent seed funding signals, where lived operating experience shortens diligence.

Anne Neuberger, Zach Frankel and Yinon Costica also invested as individuals. When operators write personal checks into a security company, they are usually validating the threat rather than the roadmap.

What an Inline Firewall Actually Blocks

AIR describes its product as an inline firewall for AI agents. It finds agents already running inside a company, continuously vets the plugins and skills those agents load, and blocks malicious instructions before they reach an agent’s context.

That last step is the interesting one. Most current defenses inspect what a model produces, so a harmful instruction has already shaped the reasoning by the time anyone reviews the output. Stopping the instruction earlier changes the economics of the attack.

Think of it as the difference between reading your mail and screening it. One approach catches problems after they influence a decision. The other prevents the decision from being poisoned at all.

The Add-On Supply Chain Is the Weak Point

AIR’s own research puts numbers on the risk. The company catalogued more than 17,800 publicly available AI add-ons carrying roughly 6.7 million installs, and it identified skills impersonating both Anthropic and OpenAI that could execute arbitrary code on enterprise systems.

Founders should recognize this shape immediately. It is the package registry and browser extension problem again, except the payload now sits inside a system you have deliberately handed credentials and autonomy.

Why Small Teams Carry the Most Exposure

Large enterprises have procurement functions that slow adoption down. Startups do not, so an engineer can wire an agent into billing data on a Tuesday afternoon and nobody reviews it.

Speed is the advantage, of course, but it cuts both ways. The same missing process that lets a five-person team ship weekly also means nobody tracks which agents hold which credentials, and that gap widens as AI agent interoperability makes tools easier to chain together.

For a structured starting point, the NIST AI Risk Management Framework is free and written for organizations without a dedicated security function. It will not solve the problem by itself. It does give you shared vocabulary and a defensible checklist.

A Short Checklist Before Agents Touch Live Data

You do not need a fifty million dollar platform to close the obvious gaps. Start with an inventory, because you cannot govern agents you cannot name.

• List every agent running against company systems, including ones on personal accounts.
• Record which credentials and which data each agent can reach.
• Pin plugin and skill versions rather than letting them update automatically.
• Require human approval for anything that moves money or deletes records.
• Log agent actions somewhere a person actually reads each week.

Then treat this as recurring work instead of a one-time project. Teams that already automated parts of their defense, as covered in our look at AI cybersecurity, tend to catch drift much faster than teams running annual reviews.

Agent Security Questions Founders Keep Asking

Do small companies need dedicated AI agent security tooling?

Not yet, in most cases. You do need an inventory of your agents and their permissions, and that costs nothing but an afternoon.

What is prompt injection in plain terms?

It is text hidden in a document, web page or plugin that an agent reads as an instruction. The agent then follows it as though you had asked.

Are official-looking plugins safe to install?

Not automatically. AIR found add-ons impersonating major AI vendors, so verify the publisher before installing anything that gets system access.

What Comes Next for Agent Governance

Expect insurers and enterprise buyers to start asking about agent controls inside security questionnaires over the next few quarters. That is usually how a niche security category turns into a checkbox everyone has to complete.

Get ahead of it now, while your footprint is still small. Writing down which agents you run is far easier at ten agents than at two hundred.