AIR Security banks $50 million six months in on a census of 17,800 untrusted AI add-ons

The asset being priced is the research. It is not the product, which the report describes only as an inline firewall filtering what enters an agent's context rather than fencing what the agent is permitted to do ^[6]. And it is not revenue, since Calcalist's account carries no valuation, no revenue figure and no customer count ^[7]. Two studies do the work of a pipeline: more than 17,800 public AI add-ons, across roughly 6.7 million installations, taking instructions from untrusted external sources ^[11], and AI Skills wearing Anthropic and OpenAI branding specifically to get past platform security review, one of which could execute arbitrary code on enterprise systems ^[12].

Divide those two numbers and the average flagged add-on carries about 376 installations ^[18]. That ratio describes a broad, thin problem: thousands of small artifacts rather than three big ones, so there is no single takedown that resolves it and no inventory a CISO can produce on a Friday afternoon. That is a good shape to sell a filtering layer against. It is also a shape in which most individual items are too obscure to have hurt anyone yet.

Fifty million dollars across 40 employees is $1.25 million a head ^[17], which is a hiring authorisation more than a burn rate, and the report says the focus of that headcount is a research laboratory on AI and agent behaviour ^[9]. The named senior hire is Ryan Knisley, formerly chief information security officer at Disney and at Costco ^[10]. So the money is going into evidence production and into somebody who has sat on the buying side of the table twice, which is a bet that the constraint is the procurement conversation rather than the code.

This reads differently depending on what happens next. Anthropic and OpenAI could make Skills and MCP servers signed and verifiable at install, at which point provenance is settled upstream and runtime filtering is a thinner business than $50 million implies; AIR's own finding that impersonators were built to bypass platform review is evidence that such review already exists and is being iterated on ^[12]. Or the incumbent proxy and data-loss vendors ship context filtering as a feature and AIR is bought rather than built into a category. Or the load-bearing claim holds: co-founder and CEO Yair Saban argues the danger is malicious information reaching the agent, not excessive permissions, and names installed extensions and tools, fraudulent websites and internal organisational data as the three sources ^[14], while granting that organisations are extending trust and permissions as they come to rely on agents ^[15].

This is probably wrong, but the research library looks like the more durable half of the company, because a number travels into a board deck faster than a product travels into a network path, and Saban's framing of a firewall for what enters an agent's context ^[13] is a category name attached to a citation rather than to a deployment. The thesis breaks the day installed agent tooling ships signed by default, since filtering at runtime is worth less once provenance is fixed at install. Until then, 17,800 is a question that arrives before anyone has the inventory to answer it.