AIR is a security firm that created a fake AI agent skill to highlight supply chain risks in agent ecosystems. The firm's experiment bypassed major security scanners and reached thousands of agents, underscoring the need for better vetting of external links and trust signals.