AI Agents Get Their Own Firewall the Same Week McKinsey Finds Most Enterprises Still Can't Scale Them

Three stories landed within the same two weeks, and none of them is about a model getting smarter. A security startup raised $50 million to build a firewall for AI agents, because the skills and connectors those agents install have turned out to be a real attack surface, not a theoretical one. McKinsey's biggest annual AI survey found that enterprise agent adoption keeps climbing while the share of deployments actually scaled to deliver value barely moves. And a small-business platform raised $21 million on the bet that owners will hand an agent their ad budget, not just their to-do list. Read together, they're the same story from three angles: the industry keeps extending how much authority an agent gets, faster than it's proving the authority is safe or worth it.

1. The Skill Store Needed a Firewall, and Now It Has One

AIR Security emerged from stealth on September 1 with $50 million raised across two rounds inside its first six months — Sequoia Capital led a $10 million seed, Greenoaks Capital Partners led a $40 million round that followed, with Swish Ventures and Netz Capital also in. Founders Yair Saban (CEO) and Niv Hoffman (CTO) both did offensive cybersecurity work in Unit 8200 before starting the company in February; chief strategy officer Ryan Knisley previously held the CISO seat at both Disney and Costco. The product is an "inline firewall" that discovers and evaluates every skill, plugin, MCP server, and add-on an organization's agents connect to, before and after deployment — screening for known attack patterns, external instruction sources smuggled into tool output, hidden behaviors, and packages that impersonate legitimate developer tools.

That's not a hypothetical threat model. Snyk's ToxicSkills audit, published in February, found 1,467 malicious payloads across 3,984 scanned skills — a 36% flaw rate, with 76 confirmed active malicious payloads. Within days, a campaign researchers named ClawHavoc had poisoned 1,184 skills on a popular skill registry before most teams had even heard the term. And in April, OX Security disclosed an architectural flaw in the MCP STDIO transport — it passes configuration parameters straight to the host shell without sanitization — that left an estimated 200,000 instances across more than 150 million package downloads open to remote code execution from a compromised config file. Agent skills and MCP servers became a real supply chain almost overnight, and for most of 2026 nothing sat between "install this skill" and "this skill now has your credentials." AIR is a bet that vetting that layer is now its own product category, not a feature someone bolts onto an existing security tool.

// The shape of the check AIR-style tooling runs before a skill ever touches an agent
interface SkillManifest {
  name: string;
  requestedScopes: string[];      // what data/tools it wants access to
  externalCallouts: string[];     // domains it phones home to
  publisherVerified: boolean;
}

function shouldBlock(manifest: SkillManifest): boolean {
  return !manifest.publisherVerified && manifest.externalCallouts.length > 0;
}

2. McKinsey: Adoption Is Up, Scaled Value Is Not

McKinsey's State of AI 2026 survey — 1,719 professionals across industries — found 88% of organizations now regularly use AI in at least one business function and 72% use generative AI, up from 33% in 2024. Agent adoption specifically is climbing fastest at the top: 40% of enterprises with more than $1 billion in revenue say they're scaling AI agents, up from 27% a year earlier. But nearly two-thirds of enterprises have only experimented with agents, and fewer than 10% have scaled one to deliver measurable value in any single function. The financial picture matches: only 37% of respondents attribute any EBIT impact to AI use at all, essentially unchanged from 2025, and just 6% qualify as what McKinsey calls "AI high performers." Where returns do show up, they cluster in predictable places — cost reduction in supply chain, service operations, and manufacturing; revenue gains in marketing, sales, and software engineering — which suggests the enterprises seeing results are the ones that picked a narrow, measurable workflow rather than deploying an agent broadly and hoping.

The gap between "adopted" and "scaled to value" is the more honest number to watch than adoption alone. A pilot in every department is easy to announce and doesn't require answering the AIR Security question at all, because the blast radius is small. Scaling an agent into a workflow that touches real budget or real customer data is exactly where both the ROI case and the security case get hard — and where most enterprises, per McKinsey's own numbers, still aren't.

3. Runable Bets Small Businesses Will Go First Anyway

The counterpoint to McKinsey's caution is happening at the other end of the market. Runable, founded in 2025, raised a $21 million Series A co-led by Susquehanna Venture Capital and Nexus Venture Partners, valuing the company at $65 million post-money. Its platform has reached 1.5 million users — mostly solo owners and two-person shops — and $2 million in annual recurring revenue, and it's expanding from helping small businesses build a website or product to running paid ad campaigns on their behalf across ChatGPT Ads, Meta, Google, LinkedIn, and TikTok, with the agent handling budget allocation and measurement, not just campaign drafts a human approves line by line.

A one-person consultancy has a different risk tolerance than a Fortune 500 supply chain, and it shows: Runable's users are handing agents real spending authority months before McKinsey's own enterprise respondents say they're comfortable scaling agents into a single function. That's not necessarily reckless — the downside of a bad week of ad spend is bounded in a way a bad week of automated CRM writes at enterprise scale isn't — but it's a preview of the same authority question AIR Security and McKinsey are both circling, playing out first wherever the cost of getting it wrong is smallest.

The Same Gap, Three Places

An agent's actual authority — what it can install, what budget it can move, what data it can touch — is expanding faster than either the security tooling or the measured ROI that would justify it. AIR Security exists because that expansion already produced real attacks. McKinsey's numbers show most enterprises sense the gap and are scaling cautiously as a result. Runable's growth shows where the gap gets crossed anyway, because the stakes are small enough to risk it. None of that means slow down — it means the next engineering decision on any agent project isn't "what can it do," it's "what's the blast radius if the thing vetting its inputs, or its ROI, turns out to be wrong."

Suggested visuals for this post: a simple funnel chart showing McKinsey's adoption-to-scaled-value drop-off (88% → 72% → 40% → <10%); a timeline of the 2026 agent-skill security incidents (ToxicSkills in February, ClawHavoc days later, the MCP STDIO disclosure in April, AIR Security's September launch) to show how fast the threat and the response followed each other; and a simple two-column comparison of Runable's small-business agent authority versus a typical enterprise agent pilot, to make the "who moves first" point visually.

— Maya