AIR Security Raises $50M to Build a Firewall for AI Agents

On September 1, 2026, Israeli startup AIR Security left stealth with $50 million in seed funding, split into two back-to-back rounds closed on the same day. Sequoia Capital led an initial $10 million round, and Greenoaks Capital followed immediately with a $40 million round. The six-month-old company, founded in February 2026, builds what it calls a real-time "firewall for AI agents": software that discovers which AI agents are quietly running inside a company, continuously vets the skills and plugins those agents are given access to, and blocks anything that looks like it's about to do something it shouldn't.

• $50M seed, two rounds in one day. Sequoia's $10M closed first, then Greenoaks' $40M followed immediately, with Swish Ventures, Netz, and a dense bench of angels including Wiz co-founder Yinon Costica, Eon co-founder Ofir Ehrlich, Cognition president Zach Frankel, Clay co-founder Varun Anand, former US deputy national security advisor Anne Neuberger, and musician-turned-investor Omer Adam.
• Founders with a shared history. Yair Saban and Niv Hoffman, who met roughly a decade ago in the Israeli military, now run a roughly 40-person team out of Israel, including a research lab dedicated to studying how AI agents actually behave in production.
• The product is a live gatekeeper, not a scanner. AIR discovers shadow AI agents already running inside a company, continuously audits the skills and tools those agents are granted, and blocks anomalous or dangerous actions before they execute, rather than flagging them after the fact.
• The timing is not a coincidence. The raise lands the same week Anthropic tightened Claude Fable 5.1 and Mythos 5.1 dual-use safeguards and Google shipped Gemini 3.8 Flash Cyber, part of a broader scramble by both model makers and investors to get ahead of AI-agent security before it becomes an incident report.

What does a "firewall for AI agents" actually do?

Traditional firewalls and endpoint tools were built to watch network traffic and processes for known-bad signatures. AIR's bet is that this framing breaks down once AI agents enter the picture, because an agent calling an internal API, querying a database, or pushing a deploy looks identical to a normal, authorized API call at the network layer. The only thing that tells you whether it's benign is context: which agent made the call, which skill or plugin it invoked to make it, and whether that behavior matches what the agent is supposed to be doing.

Related8090 Solutions Raises $135M to Build Software With AI Agents

AIR's platform works in three layers. First, discovery: most security teams do not have an accurate inventory of which AI agents are running inside their company, who spun them up, or what they're connected to, so AIR maps that shadow footprint the way early cloud security tools mapped unsanctioned SaaS. Second, vetting: every skill, plugin, or tool an agent is granted, the kind of read/write access to code repositories, databases, and cloud credentials that agentic workflows increasingly require, gets continuously audited rather than approved once and forgotten. Third, enforcement: when an agent's tool call deviates from expected behavior, AIR blocks it in real time, treating the skill or plugin as the attack surface rather than the agent itself.

That last point is the crux of AIR's pitch. As companies wire AI agents into internal systems, those agents are getting granted meaningful access, often through unaudited third-party skills or plugins built by teams with no security review process. A compromised or maliciously designed skill can act as a Trojan horse: the agent behaves normally right up until the moment the tool it's calling does something it was never supposed to do. That's a supply-chain-style problem, structurally closer to a poisoned npm package than to a phishing email, and it's one that endpoint and network tools were never built to see.

Why did investors move this fast on a six-month-old company?

A $50 million seed round for a company founded in February 2026 is aggressive by any standard, and structuring it as two back-to-back rounds on the same closing day, Sequoia's smaller lead followed immediately by Greenoaks' larger one, reads like a company that had more demand than it had room to take. Part of the explanation is the founders' pedigree and the strength of the round's angel bench: Yinon Costica helped build Wiz into a category-defining cloud security company before its acquisition by Google, and Ofir Ehrlich co-founded Eon, another well-funded name in the AI-and-cloud-security wave. When operators who've already built and sold companies in adjacent categories write personal checks into a six-month-old startup, it functions as a credibility signal that's hard for other investors to ignore.

The bigger driver, though, is timing. Enterprise adoption of agentic AI tooling has outpaced the security tooling built to govern it, and every large enterprise buyer evaluating agent platforms right now is running into the same question AIR is trying to answer: how do you know what your agents can actually touch, and who audited the plugins giving them that access. Investors chasing a category before the incident that defines it tend to move fast and write big checks up front, and a seed round shaped like a growth round is a fairly reliable tell that VCs think this window is short.

Who else is racing to secure AI agents?

AIR isn't alone, and it isn't first. Wiz built a dominant position in cloud security posture management before Google acquired it, and its alumni are now some of the most sought-after early investors in the next security wave, AIR's cap table being a clear example. Eon, co-founded by Ofir Ehrlich, has been building in adjacent cloud-data-protection territory. And the model providers themselves are treating agent security as core product work rather than an afterthought: Anthropic's tightened dual-use safeguards for Claude Fable 5.1 and Mythos 5.1, announced September 1, and Google's Gemini 3.8 Flash Cyber, shipped September 2, both target the same underlying problem from the model layer rather than the infrastructure layer, trying to make agents less exploitable by design instead of policing them after deployment.

That's a meaningful split in approach. Model providers are hardening the agent itself. AIR and companies like it are hardening the perimeter around what the agent is allowed to touch. Both bets can be right at the same time, and enterprise buyers evaluating agentic AI tools right now should expect to need both layers, not one or the other, for the foreseeable future.

RelatedHelsing Raises $1.8B at $18B Valuation for Defense AI

Our take

The honest question about AIR isn't whether the problem is real, it clearly is, but whether "firewall for AI agents" survives as a standalone product category or gets absorbed as a feature inside broader cloud security platforms within a couple of years. Wiz's own trajectory is the cautionary tale sitting right there in AIR's cap table: Wiz built a genuinely great cloud security posture product and still ended up inside Google rather than staying independent. Categories defined by a single, sharp insight, in this case that agent behavior needs to be evaluated by intent rather than by network signature, tend to get validated fast and then swallowed by whoever already owns the security budget line.

That said, AIR has real structural advantages for the next 18 months: a founding team that's spent six months exclusively studying agent behavior in a dedicated research lab, a war chest large enough to move faster than most seed-stage security startups, and investors who've already lived through exactly this consolidation cycle once with Wiz and know what winning it looks like. Whether AIR ends up as the durable platform or as an acquisition that makes someone else's platform better, this raise is a strong signal that AI-agent security has moved from "interesting research problem" to "line item enterprises are actively budgeting for" faster than most people expected.

Readers tracking the broader funding wave behind AI-agent security can follow more rounds like this one on GenZTech's own Funding Tracker, and see how it stacks up against other major raises on the Biggest AI Funding Rounds page.

Original analysis by GenZTech. Sources: TechCrunch.