Sequoia Backs Air to Secure the AI Agent Supply Chain

Sequoia Backs Air to Secure the AI Agent Supply Chain Sequoia Capital announced its investment in Air, a cybersecurity startup founded by Unit 8200 veterans Yair Saban and Niv Hoffman that addresses supply chain and runtime security risks in AI agents. Prior to Air, the founders built MOAK, an autonomous agentic workflow capable of weaponizing newly disclosed vulnerabilities without human intervention. Air demonstrated major supply chain vulnerabilities in agent ecosystems, showing that thousands of agents installed malicious or hijacked skills that bypassed existing scanners. The company developed three core security tools—Air Filter, Air Defend, and Air Control—to vet add-ons, monitor runtime behavior, and enforce central policy across enterprise agents. Following an initial seed investment, Sequoia has doubled down to lead Air's Series A financing round. Founding Background and Offensive Research Air was founded by Yair Saban and Niv Hoffman, both former leaders in Israel's Unit 8200. Before launching a defensive product, they developed MOAK, an automated system capable of producing working exploits for freshly published vulnerabilities without human intervention, which exploited a React vulnerability in 21 minutes. This research was made public to alert the industry to the growing leverage attackers gain through artificial intelligence. Uncovering Vulnerabilities in Agent Supply Chains Unlike traditional software dependencies, AI agents assemble runtime supply chains consisting of skills, plugins, model context protocol servers, and hooks that run with the agent's permissions against enterprise data. In their research, Air created a malicious skill that reached more than 26,000 agents through trusted marketplaces without being flagged by scanners. In a separate finding termed SkillJacking, they identified 925 live skills relying on dead links, enabling control over approximately 134,000 agents by registering those abandoned domains. Product Suite and Investment To address these vulnerabilities, Air introduced ScanAir, an OWASP-aligned scanner, and established a product suite covering the agent lifecycle. Air Filter evaluates add-ons via static analysis and sandbox detonation before installation; Air Defend monitors agent behavior at runtime for security operations teams; and Air Control manages enterprise permissions, visibility, and immediate skill revocation. Having previously led Air's seed round, Sequoia announced it has doubled down to back the company's Series A.

红杉资本投资网络安全初创公司Air：为AI Agent构建供应链安全防线 红杉资本宣布在领投以色列网络安全初创公司Air的种子轮后，继续加码其A轮融资。Air由以色列8200部队前成员创立，专注于解决AI Agent在运行时集成技能与插件等组件所带来的新型供应链安全隐患。 Air由来自以色列8200部队的Yair Saban和Niv Hoffman创立，此前曾开发出21分钟内全自动利用React漏洞的攻击型工作流MOAK。 AI Agent依赖技能、插件、MCP服务器等在运行时组装供应链，但目前缺乏有效检查机制且拥有较高用户环境权限。 Air团队的研究表明，恶意技能可通过可信市场扩散至数万Agent，且其披露的SkillJacking展示了通过接管失效链接控制约134,000个Agent的风险。 Air推出了涵盖Agent扩展完整生命周期的三款产品：Air Filter、Air Defend与Air Control，分别负责事前准入过滤、运行时监控与策略姿态管理。 创始团队与攻击性安全验证 Air由Yair Saban与Niv Hoffman联合创立，两人均有以色列8200部队高级技术与指挥背景。在开发防御性产品前，他们构建了名为MOAK的自动化漏洞利用工作流，能在21分钟内无需人工干预地成功利用React漏洞，以此警示业界攻击者利用AI带来的巨大杠杆效应。 AI Agent的运行时供应链风险 与传统软件类似，Agent通过整合插件、MCP服务器和技能形成复杂的供应链，并在运行时执行且具备用户级权限。Air的测试发现，恶意技能能绕过主流AI市场审查并分发给超过26,000个Agent；其SkillJacking研究更揭示有925个活跃技能依赖失效链接，Air借此控制了约134,000个安装了相关技能的Agent，而现有公开扫描工具均未能检出异常。 全生命周期安全产品矩阵 为应对上述风险，Air推出了ScanAir扫描器及三大核心产品：Air Filter通过静态分析、依赖检查和沙箱测试在事前拦截不安全安装；Air Defend对Agent运行时的实际行为进行监控、检测与响应；Air Control则用于掌握企业内Agent资产、管控访问策略并支持一键批量撤销问题技能。

We met Yair Saban and Niv Hoffman before they had a company, a name, or a product. But as we ran our references on them across the Israeli cybersecurity ecosystem, the same answer kept coming back: they would be among the strongest founding teams in the country. One of the former commanders of Unit 8200 told us Yair was "the only person I have ever thought had everything required to one day command Unit 8200" — about as strong an endorsement as exists in Israeli tech. Niv is a technical outlier who led 8200’s most important vulnerability research department, building a network of elite technical talent. Yair finished his service on a Thursday, and we shook hands on a seed investment that Saturday, which tells you all you need to know about the pace at which this team operates. Well before Yair and Niv started building a defensive security product, they built MOAK, the "Mother of All KEVs," an agentic workflow that produces working exploits for freshly published vulnerabilities with no human in the loop. In one demonstration, MOAK exploited a React vulnerability in 21 minutes, versus the six days or so it takes a typical enterprise to roll out a patch. They released it publicly, to ring an alarm bell that the industry was badly underestimating the leverage attackers can now get from AI, and that defensive tooling needed to catch up. The day developers started importing other people's packages instead of writing everything themselves, software acquired a supply chain. It then took two decades and a number of painful incidents, from log4j to Solarwinds, to build the machinery for inspecting what was coming in. Agents now have precisely the same problem, except that their supply chain is assembled at runtime and often nobody is inspecting it at all. An enterprise agent consumes skills, plugins, MCP servers, sub-agents, hooks, commands and rules — each running with the agent’s own permissions, inside a user’s environment, against a user’s data. Usually, they’re installed with the care most of us would give a browser extension. Air has spent the past several months demonstrating the stakes. They wrote a deliberately malicious skill and watched multiple AI marketplaces wave it through as safe. Their Story of Skills research showed a researcher-built malicious skill reaching more than 26,000 agents through a trusted marketplace and social media, with every scanner clearing it. Then they published SkillJacking , which showed 925 live skills were pulling their dependencies and prompts from dead links; Air registered those links and took control of the roughly 134,000 agents that had installed them. Every public scanner they tested missed the problems completely. The same day, Yair and Niv shipped ScanAir , an OWASP-aligned scanner for agentic skills. That sequence — find the hole, prove it, publish it, then ship the thing that closes it — is the pattern we like most about this team. Today, Air has three products that between them cover the full lifecycle of an agent's add-ons. Air Filter vets every add-on before an agent is permitted to consume it, using static analysis, dependency checks and sandbox detonation. It then intercepts unsafe installations in real time and offers safe alternatives in their place. Air Defend monitors what agents actually do once they’re running and provides security operations teams with detection and response capabilities for agent behavior. Finally, Air Control handles posture and policy, from knowing which agents exist and what they’re allowed to touch, to revoking a bad skill across thousands of agents at once. Think of it like home security: Air Filter is the locks and the childproofing, Air Defend is the cameras and the person watching them, and Air Control is the panel by the door — every entry point accounted for, every code assigned, and all of them revocable at once. Every couple of years, the best cyber talent coming out of Unit 8200 consolidates around a handful of teams. First it was Wiz, Cyera, and, Island; then it was Eon, Glow, Decart, and Kela; now it is Air. Yair and Niv are smart, hungry natural leaders who have proven their ability to attract extreme talent density; in only a few short months they have built a cracked team of the very best. We at Sequoia are proud to led their seed round, and to now double down in their Series A. As enterprises move toward handing agents real authority over real systems, every CISO will be asked the same questions: what is our agent actually running, where did it come from, and who checked it? Today, few have complete answers. But Air is building the system of record that will.