As enterprises race to deploy autonomous AI agents across their operations, a new startup is betting that securing those agents’ software supply chains will become one of the defining challenges of the decade. AIR Security emerged from stealth this month with $50 million in seed funding and a clear mission: build the firewall that stands between enterprise AI agents and the malicious plugins, rogue sub-agents, and permission-abusing tools that could compromise them.
The launch comes at a pivotal moment. AI agents — software systems that autonomously browse the web, execute code, query databases, and coordinate with other agents to complete complex multi-step tasks — have rapidly proliferated inside corporate environments. What was once the domain of research labs and early adopters is now standard practice at Fortune 500 companies. According to recent industry surveys, the average mid-sized enterprise is now running dozens of AI agents in production, many of which rely on hundreds of third-party plugins, MCP servers, and external tools.
That explosion of agent-to-tool connectivity has created an attack surface that traditional security tools were never built to handle.
From Unit 8200 to Silicon Valley
AIR was founded in February 2026 by CEO Yair Saban and CTO Niv Hoffman, both veterans of Israel’s elite Unit 8200 intelligence corps — the organization that has spawned a remarkable number of cybersecurity innovators over the past two decades, including founders at CrowdStrike, Check Point, and dozens of other security companies.
The pair saw the agentic AI boom coming before most enterprise security teams had even coined the term “AI agent supply chain.” They launched AIR on the thesis that as agents become the operational backbone of enterprise software, the third-party ecosystems those agents depend on would become a primary attack vector.
Their instinct proved prescient. September 2026 alone has seen several headline-grabbing incidents involving compromised AI agent plugins, including the now-infamous GitSpawn attack in which malicious instructions embedded in a rogue MCP server caused coding agents at multiple firms to push backdoored commits to private repositories. The “AI Agents PaperCut” attack earlier in the week, which compromised 440 servers by exploiting agent permission escalation, underscored the urgency.
How the Platform Works
AIR’s product takes what the company describes as a “continuous evaluation” approach. Rather than scanning plugins at deployment time and calling it done, the platform maintains a living map of every AI agent running inside a customer’s environment and continuously re-evaluates the tools those agents are authorized to call.
When an agent requests access to a new plugin or MCP server, AIR’s platform intercepts the request and runs it against a risk scoring engine that considers factors including the tool’s permission scope, its data provenance, known indicators of malicious instruction injection, and behavioral patterns observed across AIR’s broader customer base. Tools flagged as high-risk are blocked at runtime before the agent can act on them.
The system also monitors for lateral escalation — cases where a low-risk tool subsequently calls a higher-privilege tool or sub-agent, creating a chain of trust that can be exploited. Hoffman, the CTO, likens the challenge to securing a corporate network in the early days of SaaS adoption. “Every time an agent calls an external tool, that’s like opening a new port,” he told SecurityWeek. “You need to know what’s coming in and what’s going out, and you need to know it in real time.”
Funding and Investor Confidence
The $50 million came across two seed rounds closed within weeks of each other. Sequoia Capital led an initial $10 million round, reflecting the firm’s longstanding appetite for early-stage bets on fundamental infrastructure. A subsequent $40 million round was led by Greenoaks Capital, with participation from a constellation of enterprise security founders and angel investors.
The speed and scale of the fundraise signals how seriously institutional investors are taking the agentic security space. Traditional endpoint security, network security, and cloud security all followed the same arc — new computing paradigm emerges, attack surface expands, security category is created to address it. Investors who missed the early innings of endpoint detection and response or cloud security posture management are clearly determined not to repeat that mistake with agentic AI.
“Every enterprise deploying AI agents is effectively running an uncontrolled software supply chain at machine speed,” said a Sequoia partner in a statement accompanying the announcement. “AIR is building the control plane that makes it possible to operate those agents responsibly.”
The Broader Market Landscape
AIR is not alone in recognizing the opportunity. Several established cybersecurity vendors have begun extending their platforms to cover AI agents, and a handful of other startups have entered the space in 2026. But AIR is positioning itself as the category-defining pure-play, arguing that purpose-built architecture will always outperform bolt-on features from legacy vendors.
The startup’s approach is also notably developer-friendly. The platform ships with native integrations for the most common enterprise agent frameworks — Microsoft Copilot Studio, LangChain Enterprise, Anthropic’s Claude agent SDK, and OpenAI’s Agents API — and offers a policy-as-code interface that lets security teams define agent permissions using the same GitOps workflows their developers already use for infrastructure.
Why It Matters
The timing of AIR’s launch reflects a broader maturation in how enterprises think about agentic AI risk. In 2024 and early 2025, the conversation was almost entirely about model safety — hallucinations, bias, and the potential for language models to output harmful content. By late 2025, as agents began taking real-world actions on behalf of users, the focus began shifting toward operational risk: what happens when an agent does something wrong, not because the underlying model is flawed, but because it was manipulated by a malicious external actor?
That shift in threat model maps almost perfectly to AIR’s product thesis. The company isn’t trying to make models safer in the traditional AI safety sense — it’s trying to prevent agents from being weaponized by adversaries who have learned to exploit the trust relationships between agents and the tools they depend on.
For enterprise CISOs, AIR’s pitch lands at a moment of genuine anxiety. The pressure to deploy AI agents to remain competitive is intense. The pressure to do so without opening new attack vectors is equally intense. Products that credibly resolve that tension are in strong demand, and AIR’s $50 million debut suggests the market agrees.
The company plans to use the funding to expand its engineering team, deepen integrations with major enterprise platforms, and build out the threat intelligence network that underpins its risk scoring engine. With AI agents proliferating faster than any previous wave of enterprise software adoption, AIR is betting that the window to become the default agent firewall is narrow — and that it just opened.
Sources: TechCrunch | SecurityWeek | PYMNTS
