The Y Combinator startup wraps AI agents in a runtime security layer that reads intent, context and execution state together, blocks the harmful move in about 20 milliseconds, then retrains itself against whatever tried to slip through.
Ask any engineer shipping an AI agent this year what keeps them up, and the answer rhymes: the thing can read a web page, an email, or a document, and then act on it. It has hands now. It can call tools, move money, touch a database, run code. Which means a stranger who slips a sentence into that web page can, in effect, borrow those hands. This is prompt injection, and it sits at the top of the industry's list of unsolved problems. Silmaril, a San Francisco startup in Y Combinator's 2026 batch, is built around a blunt premise: filtering inputs was never going to be enough.
The company describes itself in five words on its homepage - "runtime security for AI that self-improves" - and the phrase does a lot of work. Runtime, because Silmaril runs while the agent runs, not in a quarterly audit. Self-improves, because when it sees a new attack, it retrains against it and moves on. In between those two words is the actual product: a firewall for AI agents that decides, in roughly 20 milliseconds, whether the next move is safe.
Note: performance and damage-prevention figures below are Silmaril's own, drawn from the company's site and Y Combinator launch materials. Independent benchmarks were not available at publication.
Most AI security tools today are guardrails. They inspect an input, compare it against a set of rules or a classifier, and pass or block. Useful, but shallow. A determined attacker does not send one obviously-bad message. They send a benign one, then another, then a document that quietly redefines the task, until the agent is three steps into a plan that ends somewhere it should never go. Each step, in isolation, looks fine. The harm lives in the sequence.
Silmaril's bet is that you have to watch the sequence. Its classifier reads three things at once - the user's intent, the application's context, and the execution state the agent is currently in - and asks a different question than a guardrail does. Not "is this input bad?" but "is this whole run heading somewhere harmful?" When the answer is yes, it blocks the tool call before it fires.
That framing matters because it changes what a "false negative" costs. A missed bad input is annoying. A missed bad outcome is a self-replicating worm, a leaked credential, an exfiltrated dataset. Silmaril says it has blocked exactly those categories in the wild - a self-replicating worm, a supply-chain compromise, sandbox credential theft, and a zero-click exfiltration among them - and totals the avoided damage in the tens of millions of dollars. Those are the company's numbers, and worth reading as such, but the taxonomy of attacks is real and current.
The part that separates Silmaril from a static filter is the loop. The product ships with autonomous threat-hunting agents whose job is to attack the customer's own application - probing for the multi-step chain a human red-teamer might take a week to find. When they find one, Silmaril's classifier retrains against it, the company says, in under an hour. The defense you deploy on Monday is not the defense you have on Friday.
That last idea - anonymized threat sharing - is the quietly clever one. When a novel technique is caught anywhere in Silmaril's network, the learning propagates. One customer's bad day becomes everyone else's vaccine. It is the kind of network effect that gets more valuable the more people use it, which is exactly the property a security company wants.
On its site, Silmaril publishes a comparison against named alternatives. Read it as a vendor's own scorecard - the asterisk is doing real work here - but the shape of the claim is clear enough to chart.
Whatever the exact figure, the latency story is the more interesting one. Security that adds half a second to every agent turn is security nobody keeps switched on. A 20-millisecond p90 is fast enough to be invisible, and "invisible" is the difference between a control that ships and a control that gets disabled the first time a demo feels sluggish.
Silmaril's two founders come at the problem from opposite ends of the same discipline. Aum Upadhyay, the CEO, spent time at Amazon Web Services helping build security and privacy frameworks that the company credits with preventing more than $1.8 billion in damages. That is a builder's résumé - the person who designs the guardrails at planetary scale.
Eduardo Velasco, the CTO, is the other kind of security person. A whitehat who finds the holes himself, he has reported vulnerabilities across major AI systems and, by the company's account, once chained a prompt injection all the way into root access inside ChatGPT. Silmaril also says its founders disclosed critical issues to OpenAI, Anthropic, Google and Microsoft, with Microsoft patching problems that affected millions of users.
There is a logic to that pairing. The people best at defending a system are usually the ones who have spent real time breaking one. Silmaril's product is essentially that instinct turned into software: an attacker's paranoia, running on a loop, inside your stack.
AI security in 2026 is a gold rush. Lakera, Prompt Security, Protect AI, HiddenLayer and a dozen red-teaming toolmakers are all selling some version of "we will keep your model from doing something dumb." Silmaril's wedge is threefold: it defends at runtime rather than grading you once, it targets outcomes rather than inputs, and it heals itself instead of waiting for you to update a rulebook.
The go-to-market is deliberately low-friction. Integration is, per the company, about five lines of code, through language SDKs, agent plugins for frameworks like Claude Code, OpenClaw and OpenCode, or AI gateways such as LiteLLM. You can run it as SaaS or self-hosted. The business is B2B software sold to the engineering and security teams putting agents into production - and the pitch is aimed squarely at the moment those teams realize a demo and a deployment are not the same risk.
Concretely, the people Silmaril is built for are the ones shipping tool-calling agents: a customer-support bot with database access, a coding agent that can open pull requests, an internal assistant that reads email and files and then does something with them. Each of those has the same soft underbelly - it trusts what it reads. What Silmaril lets a team do is deploy that agent without treating every untrusted document as a loaded weapon, because the firewall sits between the model's decision and the tool that would execute it. For a security lead, the practical value is being able to say yes to an agent launch instead of stalling it in review, with a control that produces an audit trail of what it blocked and why.
Silmaril is early - a team of roughly two to three, a seed-stage YC company that launched in 2026, with certifications it cites including AICPA SOC and ISO 27001 and memberships in the Cloud Security Alliance and NVIDIA's Inception program. The claims are bold and, for now, largely self-reported. But the problem it has picked is not speculative. Every company racing to give an AI agent hands is, whether they have said it out loud or not, in the market for someone to watch those hands. Silmaril is building to be that someone.
Whether the self-healing loop holds up under adversarial pressure at scale is the open question, and it is the right one to watch. If it does, "runtime security for AI" stops being a category a few startups are inventing and becomes a checkbox every agent ships with - the TLS of the agent era. Silmaril would very much like to be the default in that box.