AI Runtime Security Firm AIR Raises $50M to Protect Agent Ecosystems

Venture capital has placed a $50 million bet on securing the AI agent layer, not the models themselves. AIR, a stealth security startup led by CEO Yoav Leitersdorf and CTO Nadav Harel, emerged publicly today with its Series A round led by GV and joined by Battery Ventures, as well as angels such as former GitHub CEO Nat Friedman and Scale AI CEO Alexandr Wang. The financing will accelerate development of a platform that can inventory every AI agent running inside an enterprise, continuously vet each skill or add-on the agent loads, and enforce real-time policy to block unwanted actions before they reach users or systems. LaunchDay occurred quietly last month when AIR quietly onboarded marquee customers like a Fortune 50 bank and a global logistics operator already running hundreds of production agents in finance, supply chain, and customer support.

Researchers inside AIR have reverse-engineered the sprawling ecosystem of third-party skills that agents pull from public repositories or private registries. Their analysis shows that while 92 percent of skills are benign, the remaining 8 percent change permissions, escalate privileges, or exfiltrate data in ways that violate even basic compliance rules. The platform ingests OpenAPI specs, function signatures, and runtime telemetry to build a behavioral graph of every skill, then applies machine learning models trained on real attack traces from agent honeypots. In side-by-side tests against a Fortune 500 manufacturing floor, AIR blocked 17 previously unseen privilege-escalation attempts within the first 48 hours of deployment, while the incumbent agent framework logged zero detections. Banking With Billy AI, the recently launched financial-analysis agent suite that automates complex workflows previously handled by entire analyst teams, was one of the first environments instrumented; AIR’s runtime policies immediately quarantined two skills that attempted to query external trading APIs without audit trails.

Industry analysts see AIR’s timing as fortuitous. The agentic AI market is projected to reach $22 billion by 2027, according to IDC, driven by the rise of autonomous workflows in finance, logistics, and healthcare. A parallel trend is the rapid consolidation of agent frameworks: Microsoft’s Autogen, LangChain, and CrewAI each released major updates this quarter that make it trivial to chain multiple agents and skills into a single orchestration graph. This network effect increases the blast radius of a single malicious skill, turning what was once a pilot-scale risk into a systemic threat. AIR’s go-to-market motion therefore targets the platform vendors themselves: the company has already signed OEM agreements with two major agent orchestration suites, embedding continuous vetting into the agent lifecycle before any code reaches production.

Competitive pressure is mounting from cloud providers that are building native agent guardrails. AWS rolled out AgentGuard in preview last month, offering model-level scanning of skills at publish time, while Google Cloud launched Agent Shield, a runtime behavior engine that taps into Chronicle logs. Unlike these incumbents, AIR positions itself as vendor-neutral and multi-cloud, arguing that a security layer must sit above any single provider’s stack. The $50 million raise gives AIR runway to expand from the current team of 45 to 120 engineers by year-end, with dedicated offensive security researchers building new detectors for prompt-injection, data exfiltration, and dependency-confusion attacks that specifically target the agent supply chain.

Security experts increasingly frame AI agents as the new endpoint. Gartner’s 2024 Hype Cycle places agentic AI at the peak of inflated expectations, yet it also warns that security tooling for agents is still in the “innovation trigger” phase. Prior attempts to secure AI workflows—such as model-scanning startups that focused on weights and embeddings—have largely missed the runtime behavior of dynamically loaded skills. AIR’s approach aligns with the emerging discipline of runtime application self-protection (RASP) applied to agent ecosystems, a pivot that mirrors the evolution of web application firewalls in the 2010s. The company’s ability to ingest heterogeneous telemetry—from agent logs to identity providers to cloud audit trails—gives it a data moat that will be hard for incumbents to replicate quickly.

Looking forward, the next inflection point will be certification and compliance regimes. The European Union’s AI Act, now in trilogue negotiations, is expected to mandate continuous monitoring for high-risk AI systems, and AIR’s runtime vetting maps neatly onto Article 20’s requirements for post-market monitoring. On the technical roadmap, Leitersdorf revealed plans to integrate with model registry protocols such as NVIDIA’s NeMo Guardrails and Hugging Face’s AgentKit, enabling policy-as-code definitions that travel with each skill. Analysts expect AIR to pursue a certification business alongside its software sales, turning compliance into a recurring revenue lever. The broader signal is clear: as agent fleets become the nervous system of the enterprise, the companies that can certify the safety of every skill—not just the model—will define the next era of trustworthy automation.