%20(1).png)
AIR has been named to the AI Disruptors 60 Class of 2026, Greenfield Partners' annual list of the most groundbreaking AI startups. The class was unveiled on October 14 on stage at TechCrunch Disrupt in San Francisco and shown on the Nasdaq tower in Times Square. AIR is one of the honorees in the cybersecurity sector.
The 60 companies in this year's class have raised nearly $6 billion together, and most are less than three years old. We're grateful to be among them.
Here are some assumption we think needs disrupting
“review it once and it's safe”
Skill marketplaces, MCP registries and plugin stores follow the app store model: check the add-on when it's submitted, then list it. That model worked for compiled code. It breaks for agent add-ons.
We tested it. We built a skill and submitted it to a popular open-source skills repository with about 36,000 GitHub stars. The scanners we tested, including those from Cisco, NVIDIA and skills.sh, all rated it safe. The skill's real instructions lived at an external URL we controlled. After it was installed widely, we changed what that URL returned. Nothing re-checked it. The skill reached roughly 26,000 agents before we ended the research.
The skill's own file never changed. The risk was entirely in what it fetched.
“an LLM read the file, so the skill has been scanned”
Today's scanners, LLM-based ones included, read the skill's own text: the SKILL.md and the files bundled with it. Attackers don't need to touch that text. A skill is also the repositories it clones, the packages it installs and the domains it fetches from, and none of those are in the file. In SkillJacking we found 925 skills whose dependencies anyone could take over, used by 134,000 agents, and took over the most popular ones. In RepoJacking the author was real and the skill never changed; the repository it cloned did. AIR scans what a skill depends on, not only what it says: every repository, package and domain it references is checked to exist, to belong to who it claims, and to stay the same from one load to the next.
What replaces it
If an add-on can change after approval, review has to be continuous, and enforcement has to happen where the agent consumes instructions. That's how AIR works:
- Continuous vetting AIR Filter evaluates add-ons before install and on every load, including what they reach out to.
- Enforcement in the agent's context Inputs are filtered before the agent acts on them, whichever channel they came through.
- Trace and revoke When an add-on turns bad, security teams see every agent and workflow that depends on it and pull it across the organization.
Why it matters now
Agents are getting credentials, write access and the ability to act without a person in the loop. A poisoned add-on is no longer a bad answer in a chat window. It's an action taken in a production system.
The numbers are already large. In the Circus of Skills we found 17,822 open-source skills, with 6.7 million installations, that fetch their instructions from untrusted external sources. OWASP has since listed that attack vector in its Top 10 risks for agent skills. In MCPJacking we found 155 MCPs in the official registry that relied on expired domains. Registering them gave us remote prompt execution on every agent that trusted them.
And the add-on is now the way in. Plugin4Shell was a zero-click RCE across the four major coding agents, Claude Code, Codex, Copilot and Gemini: a trusted plugin swapped for a malicious one and auto-installed past the agent's SHA pinning. VerCellBreak showed that a rogue agent inside a hardened sandbox could still get keys out to an attacker's server. None of these needed a person to click anything. They needed an agent to load something it trusted.
That is why we built AIR around the agent's context rather than the marketplace listing. The four actions we think every enterprise should take now are in our Agent Supply Chain Framework, with a scorecard to check where you stand.
To check what your agents have installed, book a demo with AIR.
.png)
%20(1).png)