September 4, 2026
TechCrunch reported on September 1, 2026 that AIR, a startup that vets the skills, plug-ins, and MCP servers AI agents connect to inside enterprises, raised $50 million across two rounds this year -- a $10 million round led by Sequoia Capital and a $40 million round led by Greenoaks Capital, with participation from Swish, Netz, and angels including Cognition president Zach Frankel and Wiz co-founder Yinon Costica. AIR already has more than 20 customers, roughly a quarter of them large enterprises, with the heaviest demand coming from financial services and pharma. Those are not casual buyers. They're industries that already run compliance teams whose entire job is knowing exactly what's connected to what.
AIR's product has four parts, per TechCrunch's reporting: it discovers every AI agent actually running in a company's environment, including tools employees adopted on their own without approval; it continuously vets the skills, plug-ins, and MCP servers those agents pull in, checking for malicious behavior or risky changes; it enforces those checks by intercepting and blocking interactions with unapproved software or external sources; and it maintains a marketplace of pre-vetted, whitelisted add-ons. The company says it currently filters out roughly 27% of the online add-ons and skills it evaluates. That's more than one in four failing a basic trust check -- not a rounding error.
AIR CEO Yair Saban told TechCrunch that the software industry already solved a version of this problem for code dependencies: "You don't have that with skills or plug-ins or MCPs, and it's a shame, because it's the same mechanism." He's right, and it's worth sitting with why that mechanism exists at all. Software supply-chain security became a discipline because modern applications pull in packages from public registries maintained by strangers, and any one of those packages can change underneath you. Sequoia's Bogomil Balkansky put the sharper point on it: "This is not a scanning problem, it is a continuous re-verification problem." A one-time check tells you nothing about a plug-in that gets updated next Tuesday. The same logic now applies to AI agents that reach into an open ecosystem of third-party skills and MCP servers -- the connection you approved in June isn't necessarily the connection running in September.
Here's where we think the framing usually goes wrong. It's tempting to read a story like AIR's as evidence that AI agents are inherently risky. They're not, inherently. What's risky is a specific design decision: building a general-purpose agent whose value comes from its ability to pull in arbitrary third-party skills, plug-ins, and MCP servers from an open, growing marketplace it doesn't control. Every one of those connections is a door someone else built, that someone else can change later, that your security team didn't design and often didn't even know existed until a discovery tool went looking for it. The bigger and more open that ecosystem gets, the bigger and more unpredictable the attack surface gets -- which is precisely why a company now needs a dedicated product just to keep discovering and re-checking what's actually plugged in. AIR's 20+ customers and serious investor backing aren't a scare statistic; they're proof that this cost is real and that enterprises are already paying to manage it.
A purpose-built internal tool has a structurally different profile. It connects to exactly what the team wired up for one specific job -- a defined set of integrations, not an open marketplace someone else stocks and updates on their own schedule. There's no ongoing question of what skill an agent decided to load today, because there's no agent loading skills from the outside world in the first place. That's not a knock on extensible agents -- for a company that genuinely needs an agent to reach for many different tools on the fly, that flexibility is the entire point, and AIR's traction shows real demand for making that flexibility safe. It's simply a different bet, and it's the bet behind how we think about internal tools built for a specific workflow: fewer arbitrary connections by construction, not fewer connections because someone is continuously policing them.
The honest version of this story isn't "open ecosystems bad, closed tools good." It's that broad extensibility and a small, deliberate integration surface solve different problems, and a whole category of continuous-vetting infrastructure is now growing up around the first choice because that choice earns it. If you're building something that needs to plug into anything, budget for governance the way financial services and pharma already are -- our own Trust Center and security pages exist for exactly that kind of scrutiny, extensible agent or not. If what you actually need is one workflow done reliably, a narrower surface isn't a limitation you're settling for -- it's the whole reason the risk AIR was built to manage doesn't show up in the first place.
Sources