Remember when prompt injection was a parlor trick? A couple of years back, the whole genre was screenshots on social media: someone types “ignore your previous instructions” into a customer service bot, the bot cheerfully agrees to sell them a truck for a dollar, everyone laughs, and the vendor quietly patches a system prompt. It was funny because the stakes were zero. The bot could embarrass you. It couldn’t do anything.
That era is over, and the funding numbers are the tell. On September 2, 2026, Austin-based HiddenLayer announced a $100 million Series B to expand its AI security work. The investor list is the part I keep rereading: Delta-v Capital, Ten Eleven Ventures, Morgan Stanley, Microsoft’s M12, and Booz Allen Hamilton. That is not a party of AI optimists betting on a shiny new category. That is banks, defense consultants, and a security-specialist fund putting money behind the idea that AI systems in production are an attack surface with a dollar value attached.
What HiddenLayer actually claims to do
Per the company, its tools protect AI models, agents, and workflows from adversarial attacks, vulnerabilities, and malicious code injections, across agentic, generative, and predictive applications. The announcement describes HiddenLayer as the leading AI security company, which is their words, not mine. I have not run their stack, so treat everything below as an assessment of the category rather than a verdict on the product.
The three-word list in that description is doing a lot of work, though, and it maps neatly onto why this money exists. Models, agents, and workflows are three genuinely different problems that got collapsed into one buzzword. Protecting a model means worrying about what goes into it and what leaks out of it. Protecting an agent means worrying about what it decides to do with the tools you handed it. Protecting a workflow means worrying about the seams between systems, where an output from one component becomes trusted input to another with nobody checking the handoff.
Why the agent part changed the math
The reason a security company can raise nine figures now, when the same pitch would have gotten polite nods in 2023, is that we started giving models hands. A chatbot that says something stupid is a PR problem. An agent with API credentials, filesystem access, and a browser is an execution environment. Once a language model can call tools, every untrusted string it reads becomes potentially executable intent. Your model does not need to be jailbroken in some exotic way. It just needs to read a poisoned document and believe it.
That is the shift enterprises are reacting to, and the reason the buyers here are the risk-averse end of the market. When Morgan Stanley and Booz Allen are on a cap table, the customer profile is not a startup shipping a demo. It is organizations that already have security review boards, and those boards have started asking questions that most AI tooling cannot answer.
What I want to know before recommending anything in this category
Funding rounds are not product reviews. A $100 million raise tells you a market exists and investors want exposure to it. It tells you nothing about whether the tool works in your environment. If you are evaluating AI security tooling right now, mine or anyone else’s, these are the questions I would put in front of a vendor:
- What does it block versus what does it flag? Detection dashboards are easy to build and easy to ignore. Enforcement is the hard part.
- What is the false positive rate on your actual traffic? A filter that trips on legitimate user input gets turned off within a month. I have watched it happen with WAFs for twenty years.
- Where does it sit? Gateway, sidecar, SDK, or a wrapper around your model calls? Each choice has different failure modes and different latency costs.
- Does it understand your tool schema? Generic prompt filtering is a blunt instrument. Knowing that a given agent should never call the payments API is where the real protection lives.
- What happens when the vendor is down? Fail open and you have security theater. Fail closed and your product is offline.
My read
I am reasonably bullish on this category and skeptical of most individual products in it, which is an uncomfortable place to sit but an honest one. The threat is real, the demand signal from enterprises is real, and the money confirms both. What is not yet settled is whether these tools work well enough to leave switched on, because a security layer that teams disable under deadline pressure protects nothing.
The useful takeaway for anyone building with agents is smaller than the headline number. Assume every input your model reads is hostile. Scope your tool permissions like you would scope a service account. Log what your agents decide, not just what they say. Do that groundwork, and vendor tooling becomes an upgrade instead of a crutch. Skip it, and no amount of Series B money is going to save you.
🕒 Published: