An Israeli AI security company called AIR has come out of stealth with 50 million USD (about 8 billion yen) in funding. Its pitch is straightforward: inspect every skill, plug-in and MCP server a company's AI agents might install, and stop the risky ones from loading. Of the add-ons it has evaluated across the open internet, roughly 27 percent fail its checks and end up blocked.

※1 USD = 160 JPY (based on the September 1, 2026 close)

What Are You Letting Your Agents Install?

The deeper AI agents reach into company systems, the more the risk shifts away from the agent itself and toward the parts bolted onto it. Skills, plug-ins, MCP servers, assorted add-ons. These connectors are what let an agent touch the outside world, and today anyone can publish one and anyone can pull it in.

Yair Saban, AIR's co-founder and CEO, compares the situation to device drivers in the early 2000s. Back then a driver could be installed unsigned even though it loaded code straight into the kernel. Signature checks are routine now, but no equivalent exists for skills, plug-ins or MCP servers. The mechanism is the same as a driver, he argues; only the lesson failed to carry over.

What worries him more is that attackers may stop targeting the agent at all. Once an agent moves autonomously across databases and internal systems and pulls in outside content, poisoning that content is enough. From a defender's point of view, that adds an attack path which leaves very little trace.

Discover, Block, Cross-Check

AIR's product works in three layers.

The first is visibility. It maps the agents actually running in an environment, and identifies employees using AI tools that IT never approved or working through personal accounts. The idea is to surface whatever is missing from the inventory before anything else.

The second is runtime enforcement. AIR hooks directly into agents, intercepting actions such as loading a skill or fetching content from the internet, and analyzing them mid-flight. Anything that fails the criteria is stopped on the spot.

The third is a whitelist to check against. AIR continuously evaluates skills and add-ons published on the internet, watching for changes and suspicious behavior. A previously approved skill can turn dangerous if a package it depends on is swapped out or its developer's account is compromised. That continuous evaluation is where the 27 percent figure comes from: roughly that share of the add-ons the company finds are ruled out. AIR also runs a marketplace stocked only with components that pass.

Saban sees that continuous evaluation as the company's moat. Endpoint visibility, he says, is something everyone will eventually offer; keeping constant watch over the sites distributing skills and plug-ins is the hard part. Bogomil Balkansky of Sequoia, which invested, framed it as a re-verification problem rather than a scanning one, and said that re-inspecting every component an enterprise's agents touch each time it changes is an infrastructure challenge before it is a security one.

Six Months Old, Series B Money

The funding came as two seed rounds closed only weeks apart. Sequoia led the first at 10 million USD (about 1.6 billion yen), and Greenoaks led the second at 40 million USD (about 6.4 billion yen). Angel investors include Zach Frankel, president of Cognition, Wiz co-founder Yinon Costica, Eon co-founder Ofir Ehrlich, and Clay co-founder Varun Anand. For a company roughly six months old, that is an unusual amount for a seed.

Both founders came out of Unit 8200, the Israeli military intelligence corps, where they worked on offensive cybersecurity. The company now has about 40 employees and more than 20 customers, about a quarter of them large enterprises. Demand has been strongest in heavily regulated sectors, particularly financial services and pharmaceuticals.

Plenty of Companies Aiming at the Same Target

The space is already crowded. Noma Security offers discovery, access control and runtime monitoring for agents, MCP servers and skills, and Zenity sells comparable security and governance tooling. Astrix Security approaches agent and MCP server discovery and control from an identity platform, while Operant AI pairs agent protection with an MCP gateway.

The money looks similar too. Zenity raised a 125 million USD (about 20 billion yen) Series C in August, and Noma a 100 million USD (about 16 billion yen) Series B last year. Large checks are arriving before the market's shape is settled.

The AI providers themselves are expected to build filtering for malicious skills and tools into their own platforms. Saban acknowledges as much, but believes companies will still want an independent product that works across vendors. The new capital goes toward hiring researchers and expanding go-to-market efforts in the United States and Europe.

Summary

AIR emerged from stealth with 50 million USD (about 8 billion yen) behind a product that continuously inspects and blocks the skills, plug-ins and MCP servers AI agents use. The figure that roughly 27 percent of publicly available add-ons fail its bar suggests a new software supply chain is taking shape around agents. Separate from the debate over how far to trust an agent, the question of what you let an agent carry now needs managing.

※サムネイル画像はAI生成のイメージです