As generative AI transitions from static chatbots to autonomous, task-oriented agents, the enterprise threat landscape is undergoing a fundamental transformation. If AI agents are the new operating system of the modern enterprise, then AI "add-ons"—the plugins, skills, and MCP (Model Context Protocol) servers that extend agent functionality—are the new applications. This shift has created an urgent, unaddressed security vacuum that AIR Security, a startup emerging from stealth today, aims to fill.
With a massive $50 million funding round led by Sequoia Capital and Greenoaks, along with a cadre of prominent industry angels, AIR Security is positioning itself as the "firewall for AI agents." The company’s mission is to provide the visibility and control necessary to manage the burgeoning, yet largely unmonitored, supply chain of AI-driven productivity tools.
The Paradigm Shift: Agents as the New OS
The rise of agentic AI represents more than just a technological upgrade; it is a shift in how work is performed. AI agents are increasingly being granted access to sensitive enterprise data, internal email systems, and codebase repositories. They browse the web, interact with third-party services, and make high-stakes decisions on behalf of human employees.
"We’re entering a new era where using AI agents will become as elementary to knowledge work as reading, writing, and using Excel," the company stated in its launch announcement. "Agents will become a fundamental part of how enterprises build, operate, and make decisions—unlocking entirely new levels of speed, productivity, and what’s possible."
However, this increased autonomy comes with a significant trade-off. As these agents interact with an expanding array of external tools, they introduce a massive attack surface. When an agent is directed by an adversary through poisoned content or direct prompt injection, the resulting compromise can lead to data exfiltration, financial fraud, and unauthorized access—all while remaining invisible to traditional security operation centers (SOCs).
Chronology: From Stealth to Market Sentinel
The journey of AIR Security reflects the rapid escalation of AI-related threats. Founded by CEO Yair Saban and CTO Niv Hoffman, the company spent its initial period in stealth mode conducting deep-dive research into the "wild west" of AI add-ons.
They were soon joined by Ryan Knisley, a veteran cybersecurity executive who previously served as CISO at both The Walt Disney Company and Costco Wholesale. Knisley’s appointment as Chief Strategy Officer underscores the company’s intent to solve enterprise-grade security problems that keep Fortune 500 CISOs awake at night.
The company’s research phase unearthed alarming trends:
- Massive Proliferation: AIR identified over 17,800 public AI add-ons, accounting for 6.7 million cumulative installations, that rely on untrusted external instruction sources.
- Malicious Impersonation: The research team discovered "AI Skills" currently in circulation that mimic trusted entities like OpenAI and Anthropic. These malicious add-ons are specifically designed to bypass standard security reviews, allowing them to execute arbitrary code within an enterprise’s environment.
- The Coding Agent Explosion: The adoption of tools like Claude Code, Cursor, and Codex has surged within software development teams. While these tools significantly boost developer velocity, they also represent a "seatbelt-less" risk that enterprises are struggling to govern.
Supporting Data: The Anatomy of Agentic Risk
To understand the necessity of a dedicated AI firewall, one must look at the technical architecture of these agents. Unlike traditional software, which is vetted through CI/CD pipelines and static analysis, AI agents are often dynamic. They can install new tools on the fly and connect to internal systems without human intervention.
AIR’s research suggests that the "agentic supply chain" is currently a black box. Many add-ons do not behave linearly; they can change their functionality based on the data they ingest or the instructions they receive from external sources.
The security implications are profound:
- Hidden Behaviors: Some add-ons are designed to hide their true intentions, masking excessive actions or sensitive data access until the moment of execution.
- Supply Chain Fragility: A legitimate, vetted add-on can become a security risk if its maintainer pushes a malicious update or if the integration itself is compromised.
- Lack of Visibility: In most current organizational structures, there is no centralized registry for what AI agents are running, what tools they have installed, or who granted them permission to access internal databases.
Official Responses and Strategic Vision
The leadership at AIR Security is clear: the existing network-level firewalls, designed for TCP/IP traffic, are insufficient for the context-heavy, decision-making nature of AI agents.
"Every enterprise has a firewall protecting its network. Now they need one protecting their AI agents," says Yair Saban, CEO of AIR. "Today, agents are autonomously installing tools, connecting to internal systems, and making decisions—and in most organizations, nobody knows what’s running, what’s trusted, or how to shut it off."
The "AIR Firewall" acts as an intermediary layer. Before any add-on—whether third-party or internal—is permitted to interact with an enterprise agent, AIR conducts a deep analysis of its code, instructions, and potential behaviors. The firewall screens for "typo-squatted" packages (malicious packages with names similar to popular ones), unauthorized external instruction sources, and known agentic attack patterns.
If an add-on is deemed malicious or non-compliant with internal policies, security teams can trace every agent currently using that tool and revoke access organization-wide. This revocation is continuous; if a tool is compromised at a later date, the AIR system automatically pulls the trust token, ensuring that the enterprise perimeter is never static.
Implications for the Future of Enterprise Security
The emergence of AIR Security signals a maturation in the AI security market. For the past two years, the focus has been on securing the "Large Language Model" itself—preventing prompt injection or training data leaks. AIR’s approach shifts the focus toward the "Agentic Ecosystem," acknowledging that the risk lies not just in the model, but in the tools the model is allowed to wield.
1. The Rise of "Agent Governance"
Enterprises will likely adopt a new compliance framework for AI agents, similar to how they manage Software-as-a-Service (SaaS) applications today. AIR’s introduction of a marketplace of pre-vetted, certified add-ons suggests that companies will eventually demand an "app store" model for AI, where only verified, low-risk tools are permitted in the workplace.
2. A New Role for the CISO
The CISO’s role is expanding to include "AI Operations Security" (AI-OpsSec). This involves not just monitoring firewalls and endpoints, but understanding the behavior of automated agents. As agents become more autonomous, security teams will move from "policing" to "oversight," where they manage the policies that govern what agents can do, rather than trying to monitor every individual action.
3. The End of "Black Box" AI
The push for transparency in the agentic supply chain will likely force developers of AI tools to become more accountable. If tools cannot be audited by platforms like AIR, they may face exclusion from the enterprise market. This is a critical development for the long-term viability of generative AI in regulated industries like finance, healthcare, and government.
4. The Human-in-the-Loop Necessity
Despite the sophisticated nature of AI firewalls, the industry remains in a delicate state. As noted by parallel developments like OpenLeash—which integrates human checks into risky agent actions—and governmental defense pledges in the UK, the consensus is shifting toward a "trust but verify" model. AI agents are powerful, but they are not yet infallible, and the need for human oversight remains a fundamental requirement of a secure digital architecture.
Conclusion: A Necessary Evolution
As we move further into the era of agentic AI, the novelty of the technology is rapidly being eclipsed by the necessity of its governance. AIR Security’s $50 million funding round is a testament to the venture capital community’s belief that AI agents are here to stay—and that the chaos surrounding their deployment must be tamed.
By treating AI agents as a new, distinct operating system, AIR is setting the stage for a new standard in enterprise security. For companies racing to integrate Claude Code, Cursor, and other agentic tools into their daily workflows, the message is clear: innovation is essential, but it must be tethered to a security infrastructure capable of keeping pace with machine speed. The era of the "AI Wild West" is coming to a close; the era of the managed, secure, and authenticated AI agent has begun.
