Air Raises $50M: The Real Budget War Is Containment

If this landed in Promotions or Other, move it to your main inbox. One move keeps it there.

So, What Actually Happened?

Wednesday morning, and I keep coming back to one line from a funding announcement. A company called Air raised $50 million to build a firewall for AI agents, and the pitch was not that agents are powerful. It was that in most companies nobody knows how to switch one off. We scanned 190,000 articles this week so you don't have to. Same forty-eight hours: the Hugging Face breach put the place your team downloads models from on every security leader's desk, and Progress agreed to buy Domo's data platform. I went looking for the capability story, the one where something got smarter. Found fences instead: what an agent may install, where a model came from, who owns the table underneath it. The pitch all year was autonomy. What people are actually buying is containment.

The Bottom Line: The agent got the budget last year. This year the budget goes to whatever can see it, vet it, and stop it.

The Tracks That Matter

1. Somebody Raised $50 Million To Put A Bouncer On Your Agents

Air came out of stealth with $50 million in seed funding from Sequoia and Greenoaks, and the money is less interesting than the problem statement. Greenoaks partner Patrick Backhouse said it plainly: agents pull skills, plugins, add-ons and MCPs from sources no security team has reviewed. That is not a model problem. That is procurement, happening at runtime, with nobody signing anything. The same week, enterprise engineers were making the case for turning AI policy into executable controls rather than PDFs, which is the identical idea approached from the other end. A rule nobody can run is a rule nobody follows. Two budgets, two vocabularies, one gap between them.

Here's what works: List every agent running in production, and next to each one write the name of the person who can switch it off today.

2. The Shop Your Team Downloads Models From Got Breached

Security teams spent the start of the week working through the Hugging Face breach and the questions it forces: which models did we pull, from whose account, and what did they reach once they landed. Most enterprises cannot answer the first one, because nobody keeps a bill of materials for weights the way they do for libraries. In the same news cycle, attackers were actively exploiting flaws in PaperCut, an unglamorous print server sitting inside hospital networks. Old lesson, new wardrobe: the way in is the boring dependency nobody owns. Your AI supply chain is a software supply chain. It just has fewer signatures on it.

Here's what works: Pin and checksum every model you pull from a public hub. If you cannot name the version in production, you are not running it, you are hosting it.

3. Progress Buys Domo And The Data Floor Gets Re-Plumbed

While everyone watched the agents, the ground under them changed hands. Progress Software agreed to acquire Domo's AI and data platform business, which takes a well-known dashboard company and files it inside somebody else's stack. Around the same time, Snowflake and Palantir opened zero-copy access in both directions, so data gets queried where it already sits instead of being shipped to a third place first. Read them together and they say one thing: value moved from the picture on the screen to the table underneath it. Agents raise the stakes on that, because an agent reading a wrong number does not argue about it in a meeting. It acts on it, at machine speed, forty times before lunch.

Here's what works: Before the next agent pilot, name the single table it reads from and the person who owns that table. If that is unclear, you have a demo, not a pilot.

Quick hits:

• The banks are writing the cheques now, not just clearing them. Goldman Sachs led a $240 million AI round, which tells you the capital stack behind AI is widening past the venture firms everyone quotes.
• Frontier models are moving inside the walls. VMware Cloud Foundation is bringing leading AI models into private datacenters, aimed squarely at the buyer who wants the capability without the jurisdiction argument.
• Earth observation got a foundation model. ESA and IBM built TerraMind for satellite data, the sort of domain-specific model that quietly becomes infrastructure for insurers and agriculture before anyone writes it up.

Signal vs. Noise

🟢 Signal: The data floor under the agents. Data quality, data governance and data integration all gained real hold across the industry this week, and you can see why in the deals: a dashboard business sold into a bigger data stack, two platforms opening direct access to each other's tables. Most coverage is still counting agent launches and missing that the buying moved one floor down.

🔴 Noise: ”Agentic AI” as a label. It pulled heavy volume again while losing its grip on the stories actually moving underneath it. Everything is agentic now, so the word tells you nothing about what changed. Watch what teams are expensing instead: firewalls, catalogs, kill switches.

From the 190K

We scanned 190,000 articles this week. Here's what no one's talking about:

Air raised $50 million for an agent firewall, Hugging Face got breached, and Progress bought Domo's data platform, all inside the same news cycle.

Three desks, three filings. The venture press writes Air as a hot seed round. The security press writes Hugging Face as an incident report. The enterprise-software press writes Progress and Domo as consolidation in a crowded BI market. Read them on one morning and they are a single story about control: what an agent is allowed to install, where the weights came from, who owns the table it reads. For two years the money went to making agents capable. This week it went to making them accountable, and those are bought from completely different vendors by completely different people who have never been in a meeting together.

What changes on Thursday is small and specific. Take your top agent use case and write three lines: who can stop it, where its model came from, which table it trusts. If you can fill in all three from memory, you are ahead of most of the market. If you cannot fill in any, that is not a governance problem yet, it is an inventory problem, and inventory is cheap to fix in September and expensive to fix after an incident.

By The Numbers

• Air raised $50 million in seed funding to build a firewall for AI agents — Sequoia and Greenoaks backing a control layer before most companies can list the agents they are already running.
• Goldman Sachs led a $240 million AI funding round — when the investment banks lead rather than follow, the asset has stopped being speculative and started being underwritten.
• Runable raised $21 million in Series A funding — mid-size cheques are still landing for AI platforms, which is the part of the market that goes quiet first when sentiment turns.
• Atorie closed a $9.5 million seed round — a16z speedrun among the backers, the early end of the pipeline that shows you what gets funded twelve months from now.
• Multimodal AI is forecast to triple enterprise GPU demand by 2027 — text was the cheap part. Images, audio and video are what turn an inference bill into a capital plan.
• See what's rising across AI and data this week →

Deep Dive: The Night I Let Someone Plug Into The Booth

Years back, a friend of a friend asked to put a USB stick into the deck mid-set. Nice guy, good taste, and I said yes because the room was moving and saying no would have cost me thirty seconds of momentum. The file did something the player did not like. One deck froze. Full room, sudden silence, and my hand on a knob that had stopped meaning anything.

The booth had no bouncer

That is the Air pitch, minus the venture capital. Agents install their own tools, connect to internal systems and act, and the honest answer to ”what is running right now” is a shrug from three departments. Nobody vetted the USB stick because nobody thought of it as a supplier.

The shop had no receipts

Then the supply itself takes a hit. A breach where teams pull their models from is not a model-quality question, it is provenance. If you cannot say which weights are in production and whose account they came from, you do not have a security problem yet. You have an inventory you never took.

The floor was already moving

Underneath both, the data layer is being bought and rewired: dashboards absorbed into bigger stacks, platforms opening direct doors to each other's tables. The agent everyone is arguing about sits on the top floor of a building whose foundations changed owner this week.

What Actually Works

1. Name the kill switch: every production agent gets one human who can stop it today, written down, not assumed.
2. Allow-list what enters the context: approved skills, plugins and MCPs only. Everything else blocked by default, reviewed on request.
3. Pin your provenance: version and checksum models from public hubs the same way you already do for open-source libraries.
4. Compile one policy: take a single line from your AI policy and turn it into a control that runs in the pipeline and fails the build. One beats twelve on a slide.

Nobody in that room remembered the track. Everybody remembered the silence.

What's Coming

Agent Inventory Becomes An Audit Question

Air's firewall for AI agents is a product answer to a question auditors have not formally asked yet. They will. Expect ”list your production agents and their permissions” to appear in a compliance questionnaire this autumn, and expect the first honest answers to be embarrassing.

Europe Reopens Its Own Privacy Rulebook

The European Commission's Digital Omnibus proposes amendments to GDPR-related regulation, and the debate about whether that is simplification or dilution is already running. Teams that built compliance as documents rather than controls will be rewriting whichever way it lands. Build it once, in code.

Debt Quietly Replaces Equity In The Build-Out

The ECB is now writing about US tech giants tapping euro area bond markets, which is what happens when the compute build-out outgrows cash flow. When central bankers start describing your vendor's funding structure, the vendor's pricing gets less flexible, not more.

For Your Team

Thursday's meeting prompt: ”Name every AI agent running in our production systems, who can switch each one off, and where its model came from. If we cannot answer that in this room, what exactly are we approving in the next pilot?”

Share-worthy stat: Investors just put $50 million into a firewall for AI agents, on the argument that most companies cannot say what their agents are running or how to shut them off. The control layer got funded before the inventory got taken.

Go deeper: Track where AI control and data spend are moving →

The Track of the Day

”In most organizations, nobody knows what's running, what's trusted, or how to shut it off.”
Yair Saban, co-founder and CEO, Air

That is a sentence about AI agents, and it is also a sentence about half the data platforms I have walked into over twenty years. The technology changed. The question at the door did not.

We scanned 190,000 articles this week so you don't have to. Data Pains → Business Gains.

Published: September 2, 2026 | Curated by Yves Mulkers @ Ins7ghts