Silmaril bets prompt-injection defense must self-heal: YC W26 firewall blocks in 20ms

Silmaril, a San Francisco startup in Y Combinator's Spring 2026 batch, bets that prompt-injection defense cannot be a static filter. As AI agents read web pages, emails, and documents and then act on them — calling tools, moving money, touching databases — a sentence slipped into an untrusted document can borrow the agent's hands, so the company asks a different question than the guardrails: not 'is this input bad?' but 'is this execution heading somewhere harmful?'

Co-founders Aum Upadhyay and Eduardo Velasco came from opposite sides of the same discipline: Upadhyay built security frameworks protecting AWS's AI infrastructure, and Velasco developed hardened models for Amazon's homepage. After leaving, they became whitehat hackers and, by their account, broke into OpenAI, Anthropic, Google, and Microsoft 15 times in two weeks, which convinced them attackers were ahead of every existing defense.

The product wraps agents in a runtime firewall that reads user intent, application context, and execution state, blocks a harmful tool call in about 20 milliseconds, and runs autonomous threat-hunting agents that probe each customer's app for multi-step attack chains. Verified exploits feed a retraining loop that updates deployed weights within an hour, with anonymized learning shared across deployments.

The company claims 96% block rates against real-world contextual threats versus 61% for leading guardrails and $28M of customer damages stopped, though the figures are self-reported. Silmaril is early — a team of roughly two to three — and competes with Lakera, Prompt Security, Protect AI, and HiddenLayer in a crowded AI-security gold rush.