← JOURNAL
Industry6 min

AI Agents Have a Supply Chain Problem: Inside the $50M Bet to Fix It

SolidAtoms Team
SEP 07, 2026

On September 1, 2026, an AI security startup called AIR came out of stealth with $50 million in funding — a $10 million seed led by Sequoia and a $40 million round led by Greenoaks, closed within weeks of each other. Founded by Yair Saban and Niv Hoffman, veterans of Israel's Unit 8200 intelligence unit, AIR's pitch is blunt: discover every AI agent running inside a company, continuously vet the skills, tools, and MCP servers those agents plug into, and block anything that doesn't pass. It's a firewall for what your agents are allowed to touch, plus a marketplace of pre-vetted add-ons for the things that do.

That's a large check for a narrow-sounding problem — unless the problem is bigger than it sounds. The research says it is.

The numbers behind the panic

  • Research from Noma Security, reported by Help Net Security in May, found that roughly one in four MCP servers expose functionality that can be abused for remote code execution or other state-changing operations — and that most Skills deployed in real organizations carry at least one risky characteristic.

  • Snyk's ToxicSkills audit, published in February, scanned 3,984 skills from the OpenClaw/ClawHub ecosystem — the largest public corpus of agent skills available — and found that 13.4% contained at least one critical-severity issue, 36% carried a detectable prompt injection, and reviewers confirmed 1,467 outright malicious payloads.

  • A deeper architectural flaw, disclosed by OX Security and detailed in an April Cloud Security Alliance research note, is worse than any one bad actor: the STDIO interface built into every official MCP SDK executes operating-system commands passed through configuration parameters without validation. That's a default in the reference implementation, not a bug in one server — CSA estimates it touches roughly 200,000 vulnerable instances across a supply chain of more than 150 million package downloads, with over 7,000 servers still publicly exposed with no authentication.

The most uncomfortable detail in that last report: according to the CSA note, Anthropic has acknowledged the STDIO command-execution behavior is intentional and has not committed to a protocol-level fix — leaving remediation to whoever builds on top of MCP.

Why this is a supply chain problem, not a bug list

The comparison everyone reaches for is npm and PyPI circa 2015, before typosquatting, dependency confusion, and malicious postinstall scripts became things every engineer had to think about. MCP servers and agent skills look to be following the same curve, just faster — because the thing consuming a poisoned package this time isn't a build pipeline that fails loudly, it's a model that will happily follow a manipulated tool description or an injected instruction and never flag that it did. AIR isn't the only company betting real money on this: Zenity raised a $125 million Series C in August, and Noma itself raised a $100 million Series B last year. That's close to $300 million flowing into "figure out what your agents are actually allowed to do" inside of about twelve months.

What this means if you're shipping agents

You don't need a venture-backed security platform to take the underlying lesson seriously. A few things worth doing this week if your team has agents touching production systems, customer data, or your own codebase:

  • Treat every MCP server and skill you install like a new npm dependency with install scripts — read what it actually does before you grant it access, not after.

  • Assume tool and skill descriptions are part of your attack surface. A poisoned description can shape agent behavior on every invocation without ever showing up in a code diff.

  • Sandbox or avoid STDIO-based MCP servers that pass unvalidated config into command execution. Per the CSA report, the protocol hasn't fixed this for you — so you have to.

  • Log and review what your agents actually did, not just what they were asked to do. The gap between the two is where most of these incidents live.

None of this means agents aren't worth building. It means the tooling ecosystem around them is exactly as young, and exactly as exploitable, as every developer ecosystem has been at this stage of its life. The difference this time is that the mistakes get made by something that can act with your credentials, at machine speed, without asking twice. Whether $50 million is what it costs to catch up remains to be seen — that money like this is showing up at all tells you how real the problem already is.

Sources