Hey there 👋 I spent an hour this weekend reading a security firm’s inventory of public agent skills, expecting the usual scare math. The sentence that stopped me was smaller than the headline number. Some of those skills were pretending to be Anthropic and OpenAI to get through review, then running whatever code they wanted once installed. Not a model jailbreak. A costume. That reframed the whole week for me. We keep asking which model is smartest. The people building the attacks moved on. They are working on what gets whispered into the model once it is already running. Here is my bias, for what it is worth: if you run agents in production and you cannot list the third-party skills they load, that inventory is a better use of your next hour than any model eval.
The Big ThingAIR came out of stealth with $50M to firewall what your agent readsMost agent security so far has policed what an agent is allowed to do: which tools it can call, which files it can touch. AIR Security, which launched September 1 after six months of building, is betting the real gap sits upstream of that. Its pitch is to protect what enters the agent’s context in the first place, the instructions and content a model reads before it decides to act. The funding is the smaller story. Sequoia led a $10M seed, Greenoaks led a $40M round right behind it, with Swish Ventures and Netz Capital along for it. The founders, CEO Yair Saban and CTO Niv Hoffman, both did offensive security in Israel’s Unit 8200, and they brought in Ryan Knisley, former CISO at Disney and Costco, as chief strategy officer. About 40 people. The research is the part you can act on today. AIR says it found more than 17,800 public AI add-ons, representing 6.7 million installs, that pull their instructions from untrusted external sources. Worse, it found skills impersonating trusted brands, Anthropic and OpenAI among them, to slip past platform review and then run arbitrary code. An installed skill that reads its marching orders from a web page someone else controls is a prompt injection with a supply chain attached. Grade the vendor claim like any other. These are AIR’s own numbers, published the week it wanted press, and nobody outside the company has audited the count. But the shape of the problem is obvious to anyone who has wired a third-party tool into an agent and never read what it fetches at runtime. Ship it? Nothing from AIR to deploy yet; it is a young company waving at a real hole. The finding is the deliverable. This week, list every skill and add-on your agents load, and flag any that pull instructions or content from a source you do not control. Treat those as untrusted input, the same way you would treat a form field from the open internet. Sources: AIR Security launch. SiliconANGLE and SecurityWeek carry the funding and the skill-impersonation numbers.
Tour de Headlines🔬 OpenAI’s research intern cleared a real autonomy bar. OpenAI reported that its automated “research intern” can now run structured research projects on its own that would take a human several days, which it frames as a checkpoint toward a fully autonomous AI researcher it is aiming for by March 2028. The milestone looks real; the 2028 date is a roadmap, not a receipt. The deployable version is smaller and available now: hand one well-scoped internal research task per week to an agent, behind a checklist that pins the data sources it may use, the approval steps, and a human review of the output before anyone acts on it. 💳 Cashfree’s Relay payments agent hit general availability. After running in merchant beta since May, Relay is open to every Cashfree merchant. It does not flag work for you; it executes payment operations directly on your transaction data, failed-payment retries, abandoned-cart recovery, cash-on-delivery confirmation, subscription changes, and dispute filing. The design choice worth copying is the gate: Relay asks for merchant approval before money moves and before a customer gets contacted. Cashfree says the average small business spends close to 60 hours a week on payment ops and pitches Relay to cut that under 45 minutes. That number is theirs; the two human checkpoints are the reason it is safe to try. 🎧 Genesys gave contact-center agents a control plane. Genesys Cloud added four pieces, Navigator, Orchestrator, Contextual Intelligence, and an AI Control Plane, and moved its virtual agent to a large-action model. The interesting one is the control plane. It is the observability and governance layer that lets you watch a fleet of agents for policy violations and orphaned sessions instead of hearing about them from an angry customer. Start it in a low-stakes queue, returns or password resets, and read the control-plane metrics before you widen the blast radius.
Sponsor Your team’s calls are full of signal you never grade. RapportScore reads your recorded calls and measures how your people communicate, then coaches them on it. Real measurement, not vibes. See your team’s score → |
Tool of the Day🧭 Sonar VortexStop paying the context tax on your coding agent. SonarSource put a real number on why your coding agent’s bill keeps climbing. It calls the problem the context tax: every time an agent greps and reads whole files to find its way around, those tokens get re-billed on every later turn in the session. They measured one ordinary pull request at 156 million context tokens, about $41, and a batch that averaged roughly $65 a PR with context windows brushing the 1M ceiling. Vortex swaps the grep-and-read storm for graph queries. Under it, an engine called SemSitter builds a dependency graph of the codebase, every function, class, and parameter a node, the calls and references between them typed edges, so the agent asks a targeted question and carries back just the nodes it needed instead of every file it had to scan. SonarSource claims up to 36% off token cost. What it is for: cutting the token bill and the misnavigation errors on agents working in large codebases. The steal-this holds even if you never touch Sonar: give your agent a semantic way to navigate code, and stop letting it re-read whole files to answer a question a graph could answer in one hop. Read the context-tax writeup →
Worth a Click- KB Financial ran a 116-team agent competition. 316 people across seven affiliates, grand prize to a customer-care control center. The internal agent challenge is an underrated way to surface high-value use cases with the risk review sitting in the same room. aiagentstore.ai
- Conversed.ai raised to expand its Agent Optimization Studio. Tooling that treats agents as long-lived products wired into CRM, ERP, ticketing, and health records. The orchestration layer keeps drawing money in regulated verticals. aiagentstore.ai
- AIR’s skill-impersonation finding, from the source. The primary numbers behind today’s lead, worth reading before you repeat the 17,800 figure. securityweek.com
Two companies that have never heard of each other shipped opposite halves of the same idea this week. AIR wants to firewall what gets into your agent’s context. SonarSource wants to shrink what you pay to put there. One is guarding the window, one is metering it, and neither is talking about the model. That is the tell: the base model became the boring part of the stack. Your security budget and your token bill both moved into the context window while you were comparing benchmarks. See you tomorrow.
— Ron | 
