AIR

Our case for a bigger office. 🛋️

2026 has brought a lot of new faces to AIR, and we’ve officially run out of room on the couch.

Feeling pretty lucky that these are the people we need to make room for. ❤️

🚨 𝗣𝗹𝘂𝗴𝗶𝗻𝟰𝗦𝗵𝗲𝗹𝗹 𝗶𝘀 𝗻𝗼𝘄 𝗮𝗻 𝗼𝗳𝗳𝗶𝗰𝗶𝗮𝗹 𝗖𝗩𝗘.

@AnthropicAI has assigned CVE-2026-86063 to the zero-click RCE we found in the plugin system of Claude Code and Claude Desktop.

When you install a plugin, it’s supposed to stay exactly the version that was reviewed. 𝗪𝗲 𝘀𝗵𝗼𝘄𝗲𝗱 𝘁𝗵𝗮𝘁 𝗮𝗻 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿 𝗰𝗼𝘂𝗹𝗱 𝗿𝗲𝗽𝗹𝗮𝗰𝗲 𝘁𝗵𝗮𝘁 𝘃𝗲𝗿𝘀𝗶𝗼𝗻 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲𝗶𝗿 𝗼𝘄𝗻 𝗰𝗼𝗱𝗲, and the next automatic update would install it without the user doing anything.

Anthropic fixed the issue in Claude Code 2.1.179. If you’re on an older version, we recommend updating.

🔗 Full research: na2.hubs.ly/H08PBkX0
🔗 CVE: na2.hubs.ly/H08PBlD0

Watch how we pulled it off 👇

ON AIR PARTY 🪩
What a partyyyy

Wishing that night could’ve lasted forever 🫠

BIG LOVE to our amazing AIR team and everyone who celebrated with us and made it what it was. 🥂

🚨 𝗪𝗔𝗥𝗡𝗜𝗡𝗚: 𝗜𝗳 𝘆𝗼𝘂𝗿 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁 𝘀𝗲𝘁 𝘂𝗽 𝗮 𝗦𝗼𝗹𝗮𝗻𝗮 𝗽𝗿𝗼𝗷𝗲𝗰𝘁, 𝘀𝗼𝗺𝗲𝗼𝗻𝗲 𝗲𝗹𝘀𝗲 𝗺𝗮𝘆 𝗮𝗹𝗿𝗲𝗮𝗱𝘆 𝗵𝗮𝘃𝗲 𝘆𝗼𝘂𝗿 𝗰𝗿𝘆𝗽𝘁𝗼 𝘄𝗮𝗹𝗹𝗲𝘁.

AIR’s research lab found malware in the wild that targets AI coding agents.

Here’s how it happens:
1. A developer asks their coding agent to build a Solana project.
2. The agent searches the web for a starter kit and picks the top GitHub result: 286 stars and a convincing description.
3. The agent trusts it and follows the README’s only install step: a PowerShell one-liner.
4. That step is malware. It hands an attacker full remote control of the machine, including every crypto wallet on it.

The operator isn’t new. They ran the same playbook against crypto traders. Now it’s aimed at the AI agents working for developers.

Have you used an agent to set up a Solana project on Windows? The blog lists exactly what to check for.

Read the full research: air.security/blog-posts/sol…

🏆 WOOOOHOOO
AIR has been named to the @FortuneMagazine #Cyber60 list!

The list highlights 60 cybersecurity startups shaping what comes next, and we’re proud to be one of them.

Thank you @lightspeedvp , @FortuneMagazine and @awscloud for including us. This recognition fuels our drive to keep raising the bar in AI agents security! 💪

The full list - lsvp.com/cyber60-2026-2…