AIR

AIR is the AI security platform - providing end-to-end protection across every agent, every capability they use, and every action they take.

[AIR @air__security]

A whole new world 🌎

Powered by AI agents. Secured by AIR.

Read our full story: https://t.co/ouTw5PVnUl

[AIR @air__security]

🚨 A Flaw in Anthropic’s Official Skills Allows Malicious Code Execution

AIR’s research lab discovered a vulnerability in Anthropic’s official Word, PowerPoint, and Excel skills that could let attackers run malicious code on a user’s machine.

Here’s how the attack works:
1. An attacker plants a malicious file in a shared folder, using the same name as a helper file Claude’s Office skills rely on.
2. You ask Claude to create a document. On affected Linux systems, the skill looks for that helper file to process it.
3. The skill loads the attacker’s file without checking where it came from, executing malicious code with your permissions.

We reported it to Anthropic. They acknowledged it, but consider it outside their security boundary. As of today, the skill is unchanged.

This is bigger than a vulnerability in three skills. It exposes a fundamental problem with AI agent security: trusting who built a skill doesn’t guarantee you can trust what it executes.

Read the full research: https://t.co/4t6L1VxeyT

[AIR @air__security]

Our case for a bigger office. 🛋️

2026 has brought a lot of new faces to AIR, and we’ve officially run out of room on the couch.

Feeling pretty lucky that these are the people we need to make room for. ❤️

[AIR @air__security]

🚨 𝗣𝗹𝘂𝗴𝗶𝗻𝟰𝗦𝗵𝗲𝗹𝗹 𝗶𝘀 𝗻𝗼𝘄 𝗮𝗻 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗖𝗩𝗘.

@AnthropicAI has assigned CVE-2026-86063 to the zero-click RCE we found in the plugin system of Claude Code and Claude Desktop.

When you install a plugin, it’s supposed to stay exactly the version that was reviewed. 𝗪𝗲 𝘀𝗵𝗼𝘄𝗲𝗱 𝘁𝗵𝗮𝘁 𝗮𝗻 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿 𝗰𝗼𝘂𝗹𝗱 𝗿𝗲𝗽𝗹𝗮𝗰𝗲 𝘁𝗵𝗮𝘁 𝘃𝗲𝗿𝘀𝗶𝗼𝗻 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲𝗶𝗿 𝗼𝘄𝗻 𝗰𝗼𝗱𝗲, and the next automatic update would install it without the user doing anything.

Anthropic fixed the issue in Claude Code 2.1.179. If you’re on an older version, we recommend updating.

🔗 Full research: https://t.co/BNz4K8xKeu
🔗 CVE: https://t.co/gmvGPYjdSl

Watch how we pulled it off 👇

[AIR @air__security]

ON AIR PARTY 🪩
What a partyyyy

Wishing that night could’ve lasted forever 🫠

BIG LOVE to our amazing AIR team and everyone who celebrated with us and made it what it was. 🥂

[AIR @air__security]

🚨 𝗪𝗔𝗥𝗡𝗜𝗡𝗚: 𝗜𝗳 𝘆𝗼𝘂𝗿 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁 𝘀𝗲𝘁 𝘂𝗽 𝗮 𝗦𝗼𝗹𝗮𝗻𝗮 𝗽𝗿𝗼𝗷𝗲𝗰𝘁, 𝘀𝗼𝗺𝗲𝗼𝗻𝗲 𝗲𝗹𝘀𝗲 𝗺𝗮𝘆 𝗮𝗹𝗿𝗲𝗮𝗱𝘆 𝗵𝗮𝘃𝗲 𝘆𝗼𝘂𝗿 𝗰𝗿𝘆𝗽𝘁𝗼 𝘄𝗮𝗹𝗹𝗲𝘁.

AIR’s research lab found malware in the wild that targets AI coding agents.

Here’s how it happens:
1. A developer asks their coding agent to build a Solana project.
2. The agent searches the web for a starter kit and picks the top GitHub result: 286 stars and a convincing description.
3. The agent trusts it and follows the README’s only install step: a PowerShell one-liner.
4. That step is malware. It hands an attacker full remote control of the machine, including every crypto wallet on it.

The operator isn’t new. They ran the same playbook against crypto traders. Now it’s aimed at the AI agents working for developers.

Have you used an agent to set up a Solana project on Windows? The blog lists exactly what to check for.

Read the full research: https://t.co/u2I284oEaP

[AIR @air__security]

🏆 WOOOOHOOO
AIR has been named to the @FortuneMagazine #Cyber60 list!

The list highlights 60 cybersecurity startups shaping what comes next, and we’re proud to be one of them.

Thank you @lightspeedvp , @FortuneMagazine and @awscloud for including us. This recognition fuels our drive to keep raising the bar in AI agents security! 💪

The full list - https://t.co/QGZoBotNq6

[AIR @air__security]

🚨 𝗪𝗲𝗯 𝗛𝗼𝗹𝗲: 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁𝘀 𝘀𝗲𝗮𝗿𝗰𝗵𝗶𝗻𝗴 𝘁𝗵𝗲 𝗶𝗻𝘁𝗲𝗿𝗻𝗲𝘁 𝗰𝗮𝗻 𝗯𝗲 𝗵𝗶𝗷𝗮𝗰𝗸𝗲𝗱 𝗯𝘆 𝗮𝗯𝗮𝗻𝗱𝗼𝗻𝗲𝗱 𝘄𝗲𝗯𝘀𝗶𝘁𝗲𝘀.

When your agent needs an answer, it searches the web.
It picks a result, reads the page and trusts what it finds.

But some of those results are websites that no longer exist.
The domain has expired, but the site still ranks.

𝗔𝗻𝘆𝗼𝗻𝗲 𝗰𝗮𝗻 𝗯𝘂𝘆 𝘁𝗵𝗲 𝗱𝗼𝗺𝗮𝗶𝗻, 𝗽𝘂𝘁 𝗺𝗮𝗹𝗶𝗰𝗶𝗼𝘂𝘀 𝗰𝗼𝗻𝘁𝗲𝗻𝘁 𝗼𝗻 𝗶𝘁 𝗮𝗻𝗱 𝘄𝗮𝗶𝘁 𝗳𝗼𝗿 𝗮𝗴𝗲𝗻𝘁𝘀 𝘁𝗼 𝗮𝗿𝗿𝗶𝘃𝗲.

𝗪𝗲 𝗼𝗻𝗹𝘆 𝘁𝗲𝘀𝘁𝗲𝗱 ~𝟮,𝟬𝟬𝟬 𝗲𝘃𝗲𝗿𝘆𝗱𝗮𝘆 𝗮𝗴𝗲𝗻𝘁 𝘀𝗲𝗮𝗿𝗰𝗵𝗲𝘀. 𝗛𝗲𝗿𝗲’𝘀 𝘄𝗵𝗮𝘁 𝗰𝗮𝗺𝗲 𝗯𝗮𝗰𝗸:
→ 36 expired domains still ranking in results, each one a ready-made trap for every agent that asks the same question
→ Live sites already talking to AI agents and telling them what to do
→ Sites that show agents one thing and people another
→ A GitHub repo with malicious commands hiding in its README

𝗜𝘁 𝗼𝗻𝗹𝘆 𝘁𝗮𝗸𝗲𝘀 𝗼𝗻𝗲.
One domain, bought for a few dollars, can reach every agent that lands on it. And agents run searches like these all day, every day.

𝗗𝗼𝗻’𝘁 𝗹𝗲𝘁 𝘆𝗼𝘂𝗿 𝗮𝗴𝗲𝗻𝘁𝘀 𝗴𝗲𝘁 𝘀𝘂𝗰𝗸𝗲𝗱 𝗶𝗻𝘁𝗼 𝘁𝗵𝗲 𝗪𝗲𝗯 𝗛𝗼𝗹𝗲.

Full research: https://t.co/YzogBsX0dq

[AIR @air__security]

𝗧𝗵𝗲 𝗔𝗜𝗥 𝗩𝗼𝗹𝗹𝗲𝘆 𝗖𝘂𝗽 𝗵𝗶𝗴𝗵𝗹𝗶𝗴𝗵𝘁𝘀 𝗮𝗿𝗲 𝗛𝗘𝗥𝗘 🔥

Huge thanks to everyone who played and cheered, you guys were INSANE!

Same time next year? Better start practicing 😏

@Island_io, @cyera_io , @wiz_io , @Vega_Threat, @Zafran_io, @CatoNetworks, @Enigma_AI, ZyG, @nebiusai, Koi, @DaylightSec

[AIR @air__security]

🎙️ 𝗛𝗼𝘄 𝗺𝘂𝗰𝗵 𝗮𝗰𝗰𝗲𝘀𝘀 𝗶𝘀 𝘁𝗼𝗼 𝗺𝘂𝗰𝗵?

Our Co-Founder & CTO, @niv_hoffman, joined TrashTech to talk about one of the biggest challenges in AI security: agents don’t just access our data anymore. They can use our tools, interact with our systems, and take real actions on our behalf.

𝗜𝘁’𝘀 𝗻𝗼𝘁 𝗷𝘂𝘀𝘁 𝗮𝗯𝗼𝘂𝘁 𝘄𝗵𝗮𝘁 𝗮𝗻 𝗮𝗴𝗲𝗻𝘁 𝗰𝗮𝗻 𝗮𝗰𝗰𝗲𝘀𝘀. 𝗜𝘁’𝘀 𝗮𝗯𝗼𝘂𝘁 𝘄𝗵𝗮𝘁 𝗶𝘁 𝗰𝗮𝗻 𝗱𝗼 𝘄𝗶𝘁𝗵 𝘁𝗵𝗮𝘁 𝗮𝗰𝗰𝗲𝘀𝘀.

From our malicious skill experiment that exposed over 26,000 agents to the guardrails needed to keep agents safe, Niv explains why the answer isn’t to hold AI agents back - it’s to childproof the environment. 🧸

Thank you @OmriBarak and @Tsuker for having us!

📺 Watch the full episode on YouTube - https://t.co/IcezvFKC3h
🎧 Or listen on Spotify, Apple podcast & more -https://t.co/JiNMQYSCJI

[AIR @air__security]

𝗪𝗲'𝗿𝗲 𝗵𝗼𝗻𝗼𝗿𝗲𝗱 𝘁𝗼 𝗯𝗲 𝗻𝗮𝗺𝗲𝗱 𝘁𝗼 𝘁𝗵𝗲 hashtag#𝗗𝗶𝘀𝗿𝘂𝗽𝘁𝗼𝗿𝘀𝟲𝟬 𝗖𝗹𝗮𝘀𝘀 𝗼𝗳 𝟮𝟬𝟮𝟲!

Thank you to @TechCrunch Disrupt and @GreenfieldVC for the recognition!
And a special thanks to our customers, partners, and friends for the trust, collaboration, and feedback that help shape what we build ✨

See the full Class of 2026: https://t.co/yt3HkxEgnX

[AIR @air__security]

🚨 𝗕𝗥𝗘𝗔𝗞𝗜𝗡𝗚: 𝗔𝗜𝗥 𝗿𝗲𝘀𝗲𝗮𝗿𝗰𝗵𝗲𝗿𝘀 𝗳𝗼𝘂𝗻𝗱 𝗮 𝘄𝗮𝘆 𝘁𝗼 𝗕𝗬𝗣𝗔𝗦𝗦 @vercel 's 𝗵𝗮𝗿𝗱𝗲𝗻𝗲𝗱 𝘀𝗮𝗻𝗱𝗯𝗼𝘅 and leak sensitive data to an attacker-controlled server.

Vercel Sandbox is designed to prevent AI agents from sending sensitive data to untrusted servers. And when we tested it, the protection worked.

𝗕𝘂𝘁 𝘄𝗲 𝗳𝗼𝘂𝗻𝗱 𝗮𝗻𝗼𝘁𝗵𝗲𝗿 𝘄𝗮𝘆 𝗼𝘂𝘁.

Instead of connecting to a blocked server, we got a trusted server to send the secret for us.

𝗧𝗵𝗲 𝗿𝗲𝘀𝘂𝗹𝘁?
A private key reached our attacker-controlled server, without the agent ever connecting to it directly.

𝗘𝘃𝗲𝗻 𝘁𝗵𝗲 𝗺𝗼𝘀𝘁 𝗵𝗮𝗿𝗱𝗲𝗻𝗲𝗱 𝘀𝗮𝗻𝗱𝗯𝗼𝘅 𝗰𝗮𝗻’𝘁 𝗴𝘂𝗮𝗿𝗮𝗻𝘁𝗲𝗲 𝘆𝗼𝘂𝗿 𝘀𝗲𝗰𝗿𝗲𝘁𝘀 𝘄𝗶𝗹𝗹 𝘀𝘁𝗮𝘆 𝗶𝗻𝘀𝗶𝗱𝗲.

Full research: https://t.co/Kftng9ULo1

[AIR @air__security]

SecTor 2026!
Thanks to everyone who visited our booth❤️

[AIR @air__security]

🚨 @AnthropicAI 𝗯𝘂𝗶𝗹𝘁 𝗮 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝘀𝗰𝗮𝗻𝗻𝗲𝗿 𝗳𝗼𝗿 𝗖𝗹𝗮𝘂𝗱𝗲 𝗦𝗸𝗶𝗹𝗹𝘀. 𝗢𝘂𝗿 𝗿𝗲𝘀𝗲𝗮𝗿𝗰𝗵𝗲𝗿𝘀 𝗯𝘆𝗽𝗮𝘀𝘀𝗲𝗱 𝗶𝘁 𝗶𝗻 𝟳 𝗺𝗶𝗻𝘂𝘁𝗲𝘀.

We tested thousands of skills and found three major blind spots:

→ 𝗧𝗵𝗲 𝗱𝗮𝗻𝗴𝗲𝗿 𝗰𝗮𝗻 𝘀𝗶𝘁 𝗼𝘂𝘁𝘀𝗶𝗱𝗲 𝘁𝗵𝗲 𝘀𝗸𝗶𝗹𝗹: in a link, repo, or package the scanner doesn’t check.
→ 𝗠𝗮𝗹𝗶𝗰𝗶𝗼𝘂𝘀 𝗯𝗲𝗵𝗮𝘃𝗶𝗼𝗿 𝗰𝗮𝗻 𝗯𝗲 𝗵𝗮𝗿𝗱 𝘁𝗼 𝘀𝗽𝗼𝘁: especially when it’s hidden inside complex code.
→ 𝗦𝗮𝗳𝗲 𝘁𝗼𝗱𝗮𝘆 𝗱𝗼𝗲𝘀𝗻’𝘁 𝗺𝗲𝗮𝗻 𝘀𝗮𝗳𝗲 𝘁𝗼𝗺𝗼𝗿𝗿𝗼𝘄: a skill can pass a scan and become dangerous later if something it relies on changes.

🚩 The bigger point: if Anthropic is running into these gaps, scanning AI add-ons is a MUCH HARDER problem than it looks.

Our latest research breaks down where the scanner failed - and why.

Full research: https://t.co/aEVCX2HMYM

[AIR @air__security]

🚨 Plugin4Shell: SHA-Pinning Bypass Across Major AI Coding Agents

We found the same supply-chain flaw in @claudeai Code, @OpenAI , @GeminiApp CLI and @github Copilot.

The flaw allows an attacker to replace a reviewed and trusted plugin with malicious code in any marketplace.

The result: zero-click RCE on the machine running the agent.

Thanks to @theinformation for covering the research.
Full write-up: https://t.co/0WVc4rASWC

[AIR @air__security]

SecTor by @BlackHatEvents 2026 - HERE WE GO 🔎

After AIR researchers uncovered 925 hijackable skills reaching 134,000 agents and 17,822 risky skills with 6.7M installs, one thing became clear:

🧨 There are still more victims who don’t know they’re at risk.

So the case isn’t closed. Not even close.

We’re heading to SecTor to keep following the evidence, expose what’s hiding in plain sight, and help stop the next attack before it finds its next victim.

🕵‍♂️ Meet AIR at SecTor
📍 Booth 1028

Pre-book your meeting here 👉 https://t.co/uFs6oouSDT

[AIR @air__security]

𝗔𝗜𝗥 𝗶𝘀 𝗡𝗼𝘄 𝗔𝘃𝗮𝗶𝗹𝗮𝗯𝗹𝗲 𝗼𝗻 @googlecloud 𝗠𝗮𝗿𝗸𝗲𝘁𝗽𝗹𝗮𝗰𝗲!

Google Cloud customers can now procure AIR through their existing account - consolidated billing, and drawing down on existing committed spend.

“Bringing AIR to Google Cloud Marketplace will help customers quickly deploy, manage, and grow the company’s AI supply chain security platform on Google Cloud’s trusted, global infrastructure” Dai Vu, Managing Director, Marketplace & ISV GTM Programs at Google Cloud. “AIR can now securely scale and support enterprises using its platform to help secure their AI agent fleets.”

[Yair Saban @ItsYairSaban]

Today, @air__security comes out of stealth, and I couldn’t be more excited.

Our goal is simple: make sure your next prompt is secure.

I’m incredibly grateful to our team and investors @BogieBalkansky @DeanMeyerrr @DavidCahn6 @pat_backhouse @CaspiOmri @Weiner_Lia

Let’s go!