AI agents are beginning to rely on a growing ecosystem of skills, plugins, MCP servers, sub-agents and other add-ons, creating a new software supply chain that can be difficult for security teams to track.
AIR Security, a cybersecurity company that emerged from stealth this week with $50 million in funding, says its research found thousands of AI skills relying on external resources that it classified as untrusted.
The company says the problem goes beyond malicious software. An AI agent can be given a legitimate-looking skill that directs it to retrieve additional instructions from a website, GitHub repository or software package. Those external resources can change after the original skill has been reviewed.
AIR said it scanned 142,836 live AI skills in June, including 9,570 of the most popular skills listed on skills.sh and another 133,266 skills from the broader GitHub community.
It identified 17,822 skills, or about 12.4% of the total examined, that relied on at least one external resource AIR classified as untrusted. The company said those skills represented about 6.7 million installations.
AIR grouped the external resources into several categories, including domains, GitHub repositories, code packages and hosting infrastructure.
The company said 3,409 skills referenced domains showing signals it considered suspicious or insufficiently trusted. Its indicators included recently registered domains, privacy-protected registrations, inexpensive or free top-level domains and domains resembling established brands.
AIR also identified 782 popular skills representing about 5.3 million downloads that referenced GitHub repositories or owners that met its untrusted criteria. The signals included anonymous maintainers, accounts less than a year old and accounts with little public history.
For software packages, AIR said 112 popular skills representing about 213,000 downloads referenced external packages it classified as untrusted. The company examined indicators including recent publication, typosquatting and extremely low download counts.
A further 77 popular skills, representing about 170,000 downloads, pointed to hosting infrastructure AIR considered untrusted. Its signals included connection failures, 404 responses and certain free hosting services.
AIR stressed that these indicators do not by themselves establish that every resource was malicious. Instead, the research focused on resources that could not be sufficiently trusted under the company’s methodology or could potentially change ownership or content.
The company’s broader concern is that conventional security checks may examine a skill at the time it is installed without seeing what that skill can cause an AI agent to retrieve and follow later.
In one experiment, AIR created a malicious proof-of-concept skill called brand-landingpage. The company said the skill reached more than 26,000 AI agents, including agents associated with corporate accounts.
AIR said the skill was designed to appear legitimate and directed agents to an external documentation website called stitch-design.ai, which researchers controlled and designed to resemble Google’s Stitch documentation. Google’s actual Stitch service uses the stitch.withgoogle.com domain.
According to AIR, the external documentation instructed agents to download and execute a script. The company said scanners from Cisco and Nvidia, along with scanners used by skills.sh, classified the skill as safe during its test.
AIR said it did not deploy a destructive payload during the experiment. Instead, the test skill sent researchers users’ email addresses so they could notify them about the experiment.
The result, according to AIR, demonstrated how instructions retrieved after installation can alter what an agent does even when the original skill does not contain the malicious instructions.
The company has also reported several related supply-chain risks involving abandoned accounts and external dependencies.
In research it called SkillJacking, AIR said it identified 925 skills affecting approximately 134,000 agents whose external dependencies could potentially be taken over.
One example involved a skill called seedance2-api, which AIR said had 11,483 installations. The company said the skill referenced a GitHub repository belonging to an account that had been deleted.
AIR researchers registered the abandoned username, recreated the repository and demonstrated that they could control what the skill downloaded. AIR said the researchers did not push malicious content into the public skill as part of the demonstration.
In another study, called RepoJacking, AIR reported 178 skills affecting 23,812 agents whose dependencies could potentially be hijacked.
The company said one case involved a GitHub repository associated with an account that had been renamed. After the old username became available, AIR registered it and created a repository using the expected name.
According to the company, the original skill remained unchanged, while its dependency could potentially resolve to the newly controlled repository.
AIR has also examined AI skills that appear to impersonate major technology companies.
In a study published in July, the company highlighted a skill called douyin, which it said had more than 4,400 installations and referenced what appeared to be Anthropic’s nodriver-kit through an Anthropic GitHub path.
AIR said the referenced repository was not actually present. The company then expanded its investigation and said it found skills referencing non-existent repositories under the names of Anthropic, OpenAI, Microsoft and Google.
AIR said those impersonating references appeared in skills with more than 68,600 installations.
The company’s research has also extended to Model Context Protocol, or MCP, systems used to connect AI models and agents with external tools and information.
AIR said on August 27 that it had found 155 hijackable MCPs in the official worldwide marketplace, with each relying on an expired domain.
The company said researchers registered those domains and published their own MCP servers, demonstrating what AIR described as remote prompt execution against agents that trusted the affected MCPs.
The research comes as security organizations begin formally addressing the risks associated with agentic software components.
The OWASP Agentic Skills Top 10 includes Untrusted External Instructions as AST05 and recommends controls such as maintaining an inventory of external sources, pinning content and continuously rescanning dependencies.
AIR says its response is a security platform designed specifically for AI-agent environments.
The company describes AIR Control as a system for discovering agents and governing their configurations, identities and permissions. AIR Filter is positioned as a security layer for skills, plugins, MCP servers and sub-agents, while AIR Defend is intended to monitor and protect agent activity at runtime.
AIR is also building a marketplace of pre-vetted AI-agent add-ons.
The company says its platform currently filters out about 27% of the add-ons and skills it finds online, according to comments by chief executive Yair Saban reported by TechCrunch.
AIR emerged from stealth with $50 million raised across two funding rounds. A $10 million seed round was led by Sequoia Capital, while a later $40 million round was led by Greenoaks.
Swish Ventures and Netz also participated, while listed angel investors included Zach Frankel of Cognition, Yinon Costica of Wiz, Ofir Ehrlich of Eon, Anne Neuberger and Varun Anand of Clay, among others.
The company was founded by Yair Saban and Niv Hoffman, who previously served in Israel’s Unit 8200 and worked in offensive cybersecurity. Former Disney and Costco chief information security officer Ryan Knisley has joined AIR as chief strategy officer. AIR says it has about 40 employees.
AIR says it has more than 20 customers, with roughly one-quarter classified as large enterprises. The company said financial services and pharmaceutical organizations have been among the strongest sources of demand.
The platform became available through AWS Marketplace in August, giving AWS customers another route to purchase and deploy the service.
AIR is entering a growing market. TechCrunch has reported that companies including Noma Security, Zenity, Astrix Security and Operant AI are also developing security products focused on AI agents, MCP systems and related infrastructure.
Noma raised $100 million in a Series B in 2025, while Zenity announced a $125 million Series C in August, according to TechCrunch.
The significance of AIR’s findings is not that thousands of AI agents have been confirmed as compromised. The research instead points to a developing security problem in which AI agents can depend on software and instructions that change outside the normal software review process.
A legitimate skill can remain unchanged while a domain expires, a repository changes ownership, an external package is replaced or online instructions are modified.
That makes the security of an AI agent dependent not only on the code initially approved by an organization, but also on the external components and instructions the agent is allowed to consume.
For security teams, AIR’s research suggests that tracking which agents are deployed may no longer be enough. Organizations may also need visibility into the skills, MCP servers, repositories, packages, domains and external instructions those agents use.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
