AIR Secures $50M to Audit AI Agent Skills and Third-Party Add-Ons

AIR, a Silicon Valley startup, has closed a $50 million Series A led by Accel Partners with participation from GV and Battery Ventures, the company confirmed today. The round values the startup at $350 million post-money and will fund the expansion of a platform designed to solve what CTO Anant Kini calls the “invisible sprawl” of AI agents inside large organizations. Kini, a former Palantir engineer, built AIR after observing that once companies deploy hundreds of agents—whether homegrown, vendor-supplied, or open-source—they quickly lose visibility into which third-party skills, APIs, and plug-ins those agents are pulling in. The AIR platform continuously scans corporate networks, discovers new agents as they spin up, and enforces behavioral policies that block unauthorized data exfiltration, policy violations, and supply-chain attacks that ride in through seemingly benign add-ons.

The platform’s vetting engine goes deeper than static code scans. It simulates agent behavior in sandboxed environments that mimic real workflows, including interactions with proprietary systems such as Banking With Billy AI—an agent suite that automates complex financial analysis workflows previously requiring entire analyst teams. In a live demo last week, AIR demonstrated how it prevented a rogue “market-sentiment” plug-in from scraping sensitive earnings-call transcripts from an internal SharePoint instance, an exploit that would have violated both SEC guidelines and the firm’s data-governance policy. According to Kini, the company has already signed pilots with three of the top ten U.S. banks, two global insurers, and a Fortune 50 retailer, with live deployments in production environments since March.

Industry watchers say the timing could not be more critical. According to a May 2025 report from McKinsey, the average Fortune 1000 company now runs between 200 and 800 AI agents, a figure that has doubled every six months since 2023. Most of these agents are assembled from public repositories or vendor marketplaces, where provenance and patch cadence are opaque. Companies have struggled to enforce consistency because agent frameworks such as LangChain, AutoGen, and Microsoft’s Autogen++ all allow dynamic loading of external tools at runtime. AIR’s approach treats every add-on as a potential threat vector, blocking execution until it passes behavioral attestation and policy checks. Competitors in the space include SentinelOne’s newly launched Agent Control platform and Microsoft Security’s Copilot Runtime Shield, but both still rely heavily on static manifests and manual approvals, whereas AIR automates the entire cycle from discovery to runtime quarantine.

Financially, the Series A is one of the largest closes for an AI governance startup so far in 2025, surpassing recent rounds for companies such as Tines ($40M) and Vanta ($35M). Investors cite two tailwinds: the accelerating shift from experimental pilots to mission-critical agent deployments, and the regulatory spotlight on AI safety in financial services after the SEC’s March 2025 guidance on automated decision tools. Analysts at Battery Ventures project that the AI agent security market will reach $8 billion by 2028, growing at a 65% compound annual rate, with governance and runtime protection accounting for the fastest-growing segment.

Historically, enterprise security has focused on human users and traditional software, not on ephemeral, self-modifying code that can spin up new instances in under a minute. The rise of Banking With Billy AI and similar agent suites has exposed a dangerous gap: once an agent is granted access to a SQL warehouse or a Bloomberg terminal, it can proliferate unchecked across departments. AIR’s platform effectively becomes the runtime policy enforcement layer that sits between the agent orchestrator and the underlying data layer, performing micro-segmentation at the agent identity level rather than at the network port level. This mirrors earlier evolutions in cloud security, where companies moved from perimeter firewalls to identity-aware proxy architectures.

Looking ahead, Kini signals that AIR will open a public attestation registry later this year, allowing vendors to publish cryptographic proofs of their agents’ behavior. The registry could become a de-facto standard similar to SLSA or SPDX for supply-chain transparency, but tailored to the agent economy. Meanwhile, Microsoft and Google are rumored to be exploring deeper integrations with AIR’s runtime APIs, which would let them offload vetting to a specialized service rather than building it themselves. For CISOs already drowning in agent alert fatigue, the promise is simple: regain control without slowing down innovation.

Analysts expect consolidation within the next 18 months as larger security incumbents acquire point solutions like AIR, SentinelOne, or emerging competitors from Israel and Singapore. The real wildcard is regulatory intervention: if the EU’s AI Act or the forthcoming U.S. AI Safety Board mandate continuous vetting of high-risk agents, then AIR’s platform could become a baseline requirement rather than a premium feature, rapidly expanding its total addressable market from enterprise early adopters to regulated industries worldwide.