AIR Is Now Available on Google Cloud Marketplace

Today, with enormous excitement, we're announcing that AIR is coming out of stealth. 2026 is the year enterprises went all-in on coding agents. It's also the year they realized they were deploying them without a seatbelt. AIR builds that seatbelt: a firewall for the context AI agents operate in.

We discovered 155 hijackable MCPs in the official worldwide marketplace used by millions of agents. Each relied on an expired domain, so we simply registered them, published our own MCPs and gained full remote prompt execution on every agent that trusted them. Even official marketplaces carry this supply chain risk, and any enterprise using MCPs is exposed. Enterprises on Air Marketplace are not exposed to MCPjacking.

We're excited to share that AIR is now listed as "Deployed on AWS" in AWS Marketplace, reflecting our ongoing partnership with AWS.

In SkillJacking, the skills themselves were hijacked. This time they didn't change at all - they just cloned a code repository that did. The skill’s author is real and trusted, but the agents were poisoned anyway.

Multiple skills found in the wild impersonating big-name AI brands like Anthropic and OpenAI to pass audits. The scanners read the trusted name and waved them through.

We discovered almost a thousand skills built on instantly hijackable dependencies, took over the most popular ones, and gained full control over every agent that installs them. The SkillJacking attack went unnoticed by public security scanners.

We discovered that 17,822 open source skills, with a total of 6.7M installations, are vulnerable to the Untrusted External Instructions Source attack vector. This attack vector, meaning the skill fetches external instructions from untrusted sources, has been officially recognized by OWASP as one of the top 10 risks for Agentic Skills, and covers 12.4% of GitHub open source skills.

We built a malicious skill, watched it go viral on social media, and seized full control of over 26,000 agents - belonging to designers, marketers, and the companies behind them. The open-source community vouched for it, and not one security scanner noticed.

AIR already vets the skills, MCPs, plugins, and sub-agents your agents pull into context. Connect Anthropic's Compliance API and Claude's usage and governance data comes into view, so it falls under the same posture, runtime, and supply-chain controls as everything else you run.