AIR, a security startup racing to become the compliance gatekeeper for autonomous software, has raised $50 million to help enterprises vet the skills, plugins and add-ons that AI agents install and execute on their behalf. The round underscores a fear spreading through corporate IT departments: the agent ecosystem is growing faster than anyone's ability to audit it.
Today's AI agents are not monolithic programs. They assemble capability dynamically, pulling modular skills from public registries - a browser automation package here, a payment connector there. Security researchers have warned that this plug-in culture recreates the worst lessons of early mobile app stores, where malicious extensions harvested credentials and exfiltrated data for years before anyone noticed.
AIR's answer is a verification pipeline that inspects each component with static analysis, observes its behavior inside isolated sandboxes, and assigns a trust score before an agent is permitted to use it. The company also maintains a live registry that revokes certifications when new vulnerabilities surface, giving buyers an automated equivalent of the vendor questionnaires security teams already dread.
Early customers reportedly cluster in financial services and healthcare, two sectors where regulators increasingly demand that firms document every line of code their automated systems touch. Investors frame the thesis simply: if agents become the new workforce, someone must underwrite their tools, and certification businesses tend to be very profitable ones. AIR now has $50 million to prove that referee is a viable job description.
