The driver-signing lesson from the early 2000s is about to repeat itself, and this time the stakes are higher. That’s the argument from Yair Saban, CEO of AIR, a security startup emerging from stealth with $50 million across two seed rounds to monitor the sprawling ecosystem of skills, plugins, and MCP servers that AI agents increasingly rely on. Sequoia led the first $10 million round, Greenoaks led the second $40 million, and the money closed within weeks of each other.
Saban, who co-founded the company with fellow Unit 8200 veteran Niv Hoffman, points to a gap that should feel familiar to anyone who remembers unsigned kernel drivers. “In the early 2000s, whenever you installed a driver, the driver didn’t need to be signed,” he told TechCrunch. “You don’t have that with skills or plugins or MCPs, and it’s a shame, because it’s the same mechanism, it’s the same lesson, but we haven’t learned it.” The risk isn’t theoretical: as agents work autonomously across databases and external systems, attackers can poison the content they consume rather than attacking the agent directly.
AIR’s platform does three things: discovers every agent running in a company’s environment, including shadow AI usage by employees on personal accounts; intercepts agent actions like loading a skill or fetching web content; and checks those actions against a continuously maintained whitelist. That whitelist is where Saban claims the moat lies. The startup currently filters out about 27% of the add-ons and skills it finds online, re-evaluating previously approved tools because a package dependency can change or a developer’s account can get compromised. With more than 20 customers and roughly a quarter of them large enterprises, demand is strongest in financial services and pharma.
AIR isn’t alone. Zenity raised a $125 million Series C in August, Noma Security took in $100 million last year, and Astrix and Operant AI are circling the same problem. Saban dismisses the endpoint visibility piece as commodity — “everybody’s going to do it” — and bets on continuous re-verification as the hard problem. Sequoia partner Bogomil Balkansky framed it in an emailed statement as “an infrastructure problem long before it is a security problem.” The open question is whether AI labs will eventually bake these checks in natively, which would squeeze third-party vendors. Saban’s counter: companies want independence across vendors, not a security layer controlled by the same companies building the agents.
