Tuesday, September 1, 2026 produced two announcements in a category that did not have a name a year ago. AIR Security came out of stealth with $50 million raised across two seed rounds closed inside its first six months, positioned as a firewall for the skills, plugins and MCP servers agents load at runtime. The same day CrowdStrike unveiled Falcon Guardian at Fal.Con 2026, runtime security for AI agents anchored at the endpoint.
What the category covers
Both products answer the question the last six months made unavoidable: what does this agent do at execution time, with which components, under whose review. AIR's investors framed it as agents operating with skills, plugins and MCPs from sources no security team reviewed. CrowdStrike's framing is to secure agents where they execute, on the endpoint, at runtime. A single scan at install time cannot catch a component its maintainer rewrites afterward, which is the attack that ran in the tool-poisoning cases documented this year.
What it does not cover
Runtime controls on the host see the process. They do not see the host the process is about to connect to, and they cannot govern the connection from outside the thing being attacked. Three of this year's largest agent incidents were exfiltration through an approved channel: a fetch to an attacker page, a package install from a lookalike registry host, a callback from a command that ran before the sandbox applied. In each, the host-side control watched a trusted process do a normal-looking thing.
| Control | Sees | Governs | Blind to |
|---|---|---|---|
| Endpoint runtime security | Process, tool calls, loaded components | What the agent may execute | Where the connection goes, and anything that runs outside the agent |
| Agent DNS | Every name the host resolves | Which destinations the workload may reach; first-seen held | Connections to a raw IP already in hand (egress firewall) |
| Egress firewall | Addresses and ports | Which IPs and ports may be reached | Which agent asked, and names that resolve to changing addresses |
What to do
- 01Inventory the agent runtimes your organization actually runs, including the self-hosted ones on VPS and laptops, before choosing a runtime product.
- 02Pair any host-side agent control with a resolver policy per agent role, so the two log the same incident from both sides.
- 03Require an exportable event per decision from every vendor in the stack. A control that cannot be forwarded to the SIEM is not a control the SOC can use.