Person
CTO of AIR Security, a company that scans and vets AI agent plugins and add-ons for untrusted code and supply-chain risks.
AI security startup AIR says a certificate flaw in Vercel Sandbox lets an agent send data to an attacker's server via an approved host. Vercel told AIR it needs time to find a fix, co-founder Niv Hoffman said, so operators have nothing to apply yet.
Reality
Sequoia and Greenoaks led the round for a 40-person company founded in February, which makes the priced asset a research library showing 6.7 million installs of add-ons that fetch their instructions from sources nobody vetted.
Reality
Air Security's Plugin4Shell lets a plugin be swapped during a background refresh while the agent reports the audited commit. Anthropic and OpenAI have patched, Copilot has no fix, and Google is retiring Gemini CLI.
Reality
The census behind a Sequoia-led round describes 6.7 million installations of add-ons that fetch their instructions at runtime, some of them Skills impersonating Anthropic and OpenAI to clear a security review.
Reality
The company's researchers count 17,800 public add-ons pulling unverified instructions, a number produced by the same firm selling the fix, which still leaves operators with an inventory problem they own either way.
Reality
The founders' claim is that permissions describe an agent's reach while its context decides its behaviour, and their own scan of 142,836 public skills flagged roughly one in eight as leaning on an external resource they could not vouch for.
Reality
OWASP's v1.0 standard says the payload is prose and the permissions belong to the host agent, which is another way of saying the SAST and SCA licences already on the books scan straight past the thing teams are installing this quarter.
Reality