AIR Raises $50M to Secure Agentic AI Supply Chains and Model Context Protocols

Enterprise AI security startup AIR has emerged from stealth with $50 million in seed financing across two rounds — an initial $10 million round led by Sequoia Capital followed by a $40 million round led by Greenoaks Capital. Founded by Unit 8200 veterans Yair Saban and Niv Hoffman, the platform focuses on discovering autonomous AI agents across enterprise networks, vetting their plugins, inspecting Model Context Protocol (MCP) integrations, and enforcing runtime policies against unvetted tools and poisoned context sources. The investment signals a pivotal transition in enterprise AI risk. As organisations deploy agentic frameworks that execute multi-step tool calls, access private APIs, and query third-party services autonomously, traditional perimeter security and static prompt firewalls become insufficient. Autonomous agents dynamically pull tools, execute skills, and parse untrusted data sources. An unvetted skill or malicious MCP connection can allow prompt injection or supply-chain poisoning to pivot directly into internal corporate data stores without explicit human approval. This funding round fits into the broader maturation of the AI infrastructure stack, where early-stage enterprise value is shifting from foundational model training to runtime governance, execution safety, and system-level observability. While early security tooling focused on data loss prevention (DLP) and LLM red-teaming, the rapid adoption of agentic architectures has exposed deep software supply chain vulnerabilities reminiscent of early open-source dependency risks. Securing dynamic agent execution environments and their integration points is quickly becoming a prerequisite for enterprise agent rollout. For DevOps, platform, and security engineers, this development highlights the necessity of treating AI agent tools and MCP servers like any other third-party software dependency in the CI/CD and runtime pipeline. Teams should implement automated discovery for running agents, mandate strict access policies for tool invocation, and establish continuous runtime monitoring to verify that contextual payloads and third-party skills cannot exfiltrate credentials or bypass identity boundaries.