AIR raised $50M because 27% of agent add-ons fail vetting

AIR came out of stealth this week with $50 million raised across two seed rounds, and the number worth writing down is not the funding. It is 27. The company says roughly 27% of the agent skills and add-ons it finds online do not pass its vetting (TechCrunch). If you have let a coding agent install its own tooling this month, that is your hit rate too.

What actually happened

AIR was founded by CEO Yair Saban and CTO Niv Hoffman, both out of Israel's Unit 8200. The $50M arrived as a $10M first round led by Sequoia and a $40M second round led by Greenoaks, closing within weeks of each other. Angels include Wiz co-founder Yinon Costica and Clay co-founder Varun Anand. Valuation was not disclosed. The company has around 40 employees and 20-plus customers, about a quarter of them large enterprises, with the strongest pull from financial services and pharma.

The product does three things: discovers AI agents already running inside a company, continuously vets the skills and add-ons those agents pull in, and blocks anything not on the vetted whitelist.

Why unvetted agent add-ons matter for your business

Read that product description again and notice step one. Discovery. A $50M seed round exists because enterprises cannot answer the question "which agents are running here, and what did they install?" That is not an enterprise problem. That is worse at ten people, where nobody is even pretending to keep an inventory.

The threat model is simple and it is not hypothetical. An agent skill is a text file plus a permission grant. It runs with your agent's credentials, reads whatever your agent reads, and calls whatever your agent can call. Nobody code-reviews it, because it did not come through a pull request — it came through a marketplace listing that took four seconds to add.

You do not need AIR's platform to get most of the value. You need a list. Write down every MCP server, skill file and plugin your agents can load, who approved it, and what credentials it touches. Pin versions instead of tracking latest. Give agents scoped tokens, not the same key your app uses. Then re-read the list monthly, because the marketplace changed even if your config did not.

The uncomfortable part of the 27% figure is what it implies about the other 73%. Passing a vendor's filter is not the same as being safe in your environment, with your data, holding your keys.

Sources: TechCrunch.