AI Agent Firewalls: The 2026 Supply Chain Problem

An AI agent firewall is a control that inspects what enters an agent's context — skills, plugins, MCP servers, fetched web content — and blocks untrusted material before the agent acts on it. It guards inputs rather than permissions, which is the distinction vendors in this category keep drawing.

TL;DR

Tuesday, September 1, 2026 produced two announcements in the same young category.

AIR Security came out of stealth with $50 million raised across two seed rounds, both closed inside its first six months.¹² The same day, CrowdStrike unveiled Falcon Guardian at Fal.Con 2026, its runtime security product for AI agents, anchored at the endpoint.³

The number that carried the day came from AIR's own research: more than 17,800 public AI add-ons, representing 6.7 million installations, relied on untrusted external instruction sources.⁴⁵²

That figure is real, and it is also narrower than it sounds. It measures unverified provenance, not confirmed malice — a distinction worth holding onto before anyone budgets against it.

What You'll Learn

• What AIR's 17,800 add-on figure actually counts, and what it does not
• Why these vendors argue "context" is the attack surface, not permissions
• What CrowdStrike announced, and what its press release marks as future tense
• How Zenity Labs' independent Black Hat research compares
• How much capital has landed in agent security in the last thirteen months
• Which questions to ask a vendor in this category before signing

What AIR Actually Found

AIR put three numbers behind its launch.

The headline one, in AIR's own words: more than 17,800 public AI add-ons, representing 6.7 million installations, "relied on untrusted external instruction sources."⁴ That averages out to roughly 375 installs per add-on.

The second: AIR identified AI Skills in the wild impersonating trusted brands, including Anthropic and OpenAI, to bypass platform security reviews.⁴ One of those skills was capable of executing arbitrary code on enterprise systems.⁵²

The third is operational rather than research. AIR's platform currently filters out about 27% of the add-ons and skills it finds online — more than one in four.¹

Read the first number carefully. "Untrusted external instruction sources" describes an add-on that fetches text it did not author and cannot vouch for. That is a provenance problem. It is not the same as saying 17,800 add-ons are malicious, and AIR does not say that.

The 27% figure is a different measurement again: it is AIR's own rejection rate under its own criteria, and no published methodology accompanied the launch coverage. Treat it as a vendor-reported operating statistic, not an industry baseline.

Why the Pitch Is "Firewall," Not "Scanner"

The argument AIR's founders make is that the industry has been securing the wrong layer.

"Every enterprise has a firewall protecting its network," CEO Yair Saban said. "Now they need one protecting their AI agents."²⁵

Saban's more specific claim is that permissions are not the primary danger. Agents make decisions based on whatever they encounter mid-task, so the risk sits in three places: extensions and tools installed on the agent, websites it visits, and internal organizational content.⁵

He reaches for a hardware analogy. Drivers were unsigned in the early 2000s, Saban told TechCrunch, and are signed today because they load code into the kernel. "You don't have that with skills or plug-ins or MCPs, and it's a shame, because it's the same mechanism, it's the same lesson, but we haven't learned it."¹

Sequoia partner Bogomil Balkansky framed the moat the same way: "This is not a scanning problem, it is a continuous re-verification problem."¹

Greenoaks partner Patrick Backhouse made the adjacent point in AIR's announcement, describing agents as operating at runtime with skills, plugins and MCPs "from sources that no security team has reviewed, and slipping past scanners built for yesterday's code."⁴

That framing is doing real work. A single pass at install time cannot catch a component that its maintainer rewrites afterward — which, as the Zenity research below shows, is exactly the attack that ran.

The Company Behind the Round

AIR was founded in February 2026 by Yair Saban (CEO) and Niv Hoffman (CTO), who met roughly a decade ago in the military and share backgrounds in offensive cybersecurity.⁵ TechCrunch and SiliconANGLE both identify them as veterans of Israel's Unit 8200.¹²

The $50 million arrived in two rounds closed within weeks of each other: $10 million led by Sequoia, then $40 million led by Greenoaks.¹² Swish Ventures and Netz Capital also participated, alongside angels including Wiz co-founder Yinon Costica, Clay co-founder Varun Anand, Eon co-founder Ofir Ehrlich, Cognition president Zach Frankel, and Anne Neuberger.¹⁵

The company employs about 40 people.¹² Ryan Knisley, formerly CISO at both The Walt Disney Company and Costco Wholesale, joined as chief strategy officer.⁵²

Commercially it is early. AIR claims more than 20 customers, roughly a quarter of them large enterprises, with the strongest demand in financial services and pharmaceuticals.¹ Sources differ slightly on the vetted-add-on marketplace: AIR's own announcement says it provides one, while Calcalist reported the company is still developing it.⁴⁵

CrowdStrike's Same-Day Move

Falcon Guardian was unveiled on September 1 as well, at Fal.Con 2026 in Las Vegas and positioned as an AI Detection and Response (AIDR) product.³ CrowdStrike had already made Falcon AI Detection and Response generally available on December 15, 2025, and Guardian carries the same AIDR label.⁶

The endpoint argument is CrowdStrike's whole thesis. "Governance alone can't stop an agent already in motion," CEO George Kurtz said in the release.³

The release lists eight capabilities. Four of them are the core agent controls:³

• AI Agent Discovery and Inventory — the Falcon sensor finds known and shadow agents across Windows and macOS, with a live inventory of running and dormant agents and who deployed them
• Agent Runtime Visibility — links agent behavior to endpoint telemetry, tracing prompt, identity, tool call, and skill use through to downstream system actions
• Agent Access Controls — defines which agents may run on managed endpoints and blocks the rest
• Runtime Detection and Response — reconstructs the execution chain and determines blast radius during an incident

Two of the eight are written in future tense: AI Gateway "will provide" a centralized control point for enterprise AI traffic including MCP, and Falcon Complete for Guardian "will deliver" 24/7 managed detection and response.³ The release does not state a general-availability date for Guardian.

That matters for anyone comparing the two announcements. AIR reports more than 20 customers; CrowdStrike is extending a platform it says is deployed across hundreds of millions of devices, with part of the offering still ahead of it.¹³

Independent Corroboration: Zenity Labs at Black Hat

The strongest evidence that agent add-ons are an active attack surface did not come from AIR. It landed almost a month earlier.

At Black Hat USA 2026 on August 6, Zenity Labs disclosed a credential-stealing campaign distributed through Vercel's skills.sh. The affected skill family amassed more than 1.7 million aggregate installs — installs, Zenity is careful to note, not unique users.⁷

The mechanics are the part worth reading twice. The campaign targeted users of Paperclip and Browser Use through typosquatted skills and look-alike repositories. The Paperclip skill family began accumulating installs while its skill files were still clean; attackers later weaponized them by inserting malicious installation instructions that caused agents to download and execute attacker-controlled code.⁷

Zenity calls this a time-of-check to time-of-use weakness in skill marketplaces. Clean skill, earned credibility, swapped payload.

Once executed, the malware hunted SSH keys, cloud credentials, Git and package manager tokens, Kubernetes and Docker configs, database credentials, and environment files across developer workstations, CI environments, and agent workspaces.⁷

Zenity also found dozens of additional malicious or dangerous skills in public registries. More than 30% of the dangerous skills it identified abuse Claude Code and OpenClaw as malware droppers.⁷ Vercel and Microsoft/GitHub removed the identified skills, listings, and repositories within 12 hours of notification, though Zenity notes copied instructions may persist downstream.⁷

Zenity's own conclusion is that static review is the wrong tool: "The most dangerous skills are designed to appear benign and neutralize LLM analysis while hiding malicious behavior that only emerges during execution," said CTO and co-founder Michael Bargury.⁷ The company released a free dynamic-analysis service, AI Total, that detonates a skill inside a sandbox and grades it on observed behavior.⁷

Two Numbers, Two Denominators

Here is the analytical point that gets lost when these findings are stacked into a single scary paragraph.

AIR's 17,800 counts add-ons with unverified instruction sources. Zenity's findings count skills with demonstrated malicious behavior — one campaign family plus dozens of individual skills.

Those are different populations measured by different methods. The first is a hygiene metric; the second is an incident count. An add-on that fetches unverified web content is exposed, not compromised, and AIR's figure says nothing about how many of the 17,800 were ever abused.

Conflating them produces a threat picture that is both alarming and unfalsifiable. Keeping them separate produces a usable one: the exposed surface is large, and confirmed exploitation of it is documented but so far measured in dozens of skills and one publicly detailed campaign.

Our earlier look at agent skills that are portable but rarely verified and at the framework vulnerabilities disclosed at Black Hat covers how this surface got built in the first place.

The Money in Agent Security

AIR's round is the newest, not the largest, and the category has been funding for over a year.

Sources: TechCrunch and SiliconANGLE for AIR; Zenity's own announcement; Noma's announcement.¹²⁸⁹

Zenity now reports more than 230 employees, with R&D in Tel Aviv and go-to-market run from New York.⁸ Noma came out of stealth in November 2024 and raised its Series B less than a year after the round before it.⁹

TechCrunch names Noma, Zenity, Astrix Security, and Operant AI as competitors already selling agent discovery, access control, or MCP gateways.¹ Consolidation has started too — Fortinet announced its acquisition of Virtue AI on August 17.

Saban is candid about the crowding. "The seriousness of developing software has dropped significantly. Many companies are emerging today," he told Calcalist, arguing AIR's differentiation is prevention rather than post-compromise detection.⁵

What to Ask Before You Buy

Six questions that separate the category from the marketing, based on what these announcements do and do not establish:

1. Re-inspection cadence. If the pitch is continuous re-verification, ask how often components are re-checked and what triggers a re-check. The Paperclip attack worked precisely because the review landed before the payload did.
2. Static or dynamic. Zenity's research argues static analysis misses skills whose behavior only appears at runtime. Ask which one the vendor does.
3. Rejection criteria. A 27% filter rate is meaningless without the rule set behind it. Ask what gets rejected and what the false-positive rate looks like.
4. Coverage of your actual stack. Skills, plugins, MCP servers, and subagents are different objects with different manifests. Ask which are covered today versus roadmapped.
5. Discovery of shadow agents. Both AIR and CrowdStrike lead with discovery for a reason — you cannot vet what you have not found. Ask what it detects on unmanaged devices.
6. Availability, precisely. Distinguish shipping from announced. In CrowdStrike's own release, two of the eight listed capabilities are future tense.

The Bottom Line

Two vendors announced agent supply chain products on the same Tuesday, and a third had already shown the attack works. That is what a category forming looks like.

The evidence supports the direction: the components agents pull in at runtime are unsigned, mutable after review, and reachable by attackers who understand that a marketplace listing is a promise about the past, not the present.

The evidence does not yet support the biggest version of the number. Seventeen thousand eight hundred exposed add-ons is a provenance problem worth fixing; it is not seventeen thousand eight hundred compromises. Buy against the first framing, ask hard questions about re-inspection cadence, and treat every rejection-rate statistic as vendor-reported until somebody publishes a methodology.