Silmaril is an AI security company that protects AI applications and agents from attacks such as prompt injection, tool abuse and context poisoning. Its product is an AI firewall that sits on an agent’s inference calls and blocks harmful actions as they happen.
It suits teams shipping agents into production as well as organisations whose developers use local coding agents.
At A Glance
| Vendor | Silmaril |
|---|---|
| Category | AI Model Security |
| Identities covered | AI applications and AI agents, including local coding agents |
| Deployment | Managed, or self-hosted in AWS, Google Cloud or Azure; macOS install for coding agents |
| Agentic AI | Runtime evaluation of agent tool calls, memory and trajectories |
| Certifications | AICPA SOC, ISO 27001 |
| Founded | 2026, San Francisco |
| Market classification | AI Model Security; also Agentic AI Identity |
What Silmaril Does
An agent with the right permissions can still be talked into doing the wrong thing. Permissions decide what an agent can do, not what it should do, so the firewall checks whether each action fits the task the user actually asked for, at the input, tool and output boundaries of an application.
The work runs as a three step loop. First, autonomous attack agents probe the customer’s product and chain techniques into working exploits. Next, a low-latency classifier blocks risky user intent, tool calls and context in real time. Finally, the attacks that were discovered become training data, and updated protection is in place in under an hour. Testing is therefore continuous rather than a one-off exercise, and protection keeps pace with the product it guards.
Products
Silmaril Firewall
The firewall wraps an application’s inference calls and stops harmful outcomes before they happen. Threats it handles include:
- Indirect prompt injection and unauthorised tool use
- Memory poisoning and cross-agent propagation
- Data exfiltration and supply-chain compromise
- Destructive actions
Evaluation happens while the agent runs, across tool calls, memory and the full trajectory of its work rather than a single prompt, with evaluations of up to one million tokens. Because agents increasingly hand work to each other, the firewall also covers the case where one compromised agent passes the attack on to another.
In its own benchmark of 131 attack techniques, the company reports 95.60% accuracy at a P90 latency of 20 ms.
Threat-Hunting Agents
Generic attack lists miss the paths that are specific to one product. The threat-hunting agents search for those customer-specific attack paths, and customers can opt in to sharing anonymised threat intelligence.
Firewall MCP
Security engineers who already work in an MCP client can use the Firewall MCP server to investigate findings and traffic from there, without switching to another console.
How It Works
Applications call the firewall through an SDK or a gateway, and the integration applies the returned decision according to the chosen enforcement mode. The SDK fails open by default, and policy controls how failures are handled. A classification request carries the event text and whatever context the integration supplies. A typical proof of concept runs for four weeks in non-blocking mode.
| Component | What it does |
|---|---|
| SDKs and gateways | SDKs for TypeScript, Python, Go and Java each expose a classify function called with a hook label. Through a gateway such as LiteLLM, Silmaril is called before and after each model call. |
| Enforcement modes | Shadow mode records would-block decisions while the workflow continues, which is how the quickstart begins. Block mode stops events classified as malicious. |
| macOS agent protection | Local coding agents are covered through a direct install or a managed rollout through MDM. |
| Self-hosted runtime | The application or gateway sends events to a firewall runtime in the customer’s own cloud account, which returns a verdict for the integration to enforce. Supported targets are ECS or EKS on AWS, Cloud Run or GKE on Google Cloud, and Azure Container Apps or AKS. Silmaril supplies the images, ports, startup configuration and release plan, and self-hosted inference has zero token egress. |
Identities And Systems Covered
| AI agents | Actions checked against user intent, policy and identity, including tool sequences and memory. |
|---|---|
| Coding agents | Codex, Claude Code, GitHub Copilot, Cursor, Gemini CLI, Windsurf, Cline, OpenCode, OpenClaw and Hermes. |
| AI applications | Inference calls wrapped through the SDKs and supported frameworks. |
Integrations
| Area | Integrations |
|---|---|
| Frameworks | Vercel AI SDK, LangChain, LangGraph, Deep Agents (root agents, tool execution and subagent graphs) |
| AI gateways | Claude Enterprise, LiteLLM, Vercel AI Gateway |
Company Background
| Founded | 2026 in San Francisco, United States, by Aum Upadhyay and Eduardo Velasco. |
|---|---|
| Funding | Backed by Y Combinator. |
| Research | Disclosed a reported 15 critical vulnerabilities to OpenAI, Anthropic, Google and Microsoft in two weeks, including an exploit against the ChatGPT agent and a Copilot flaw that Microsoft patched. |
Note: This overview is compiled from Silmaril’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.