Own What’s Next

THE PROBLEM

Your firewall does not understand a sentence.

That is not a criticism of your firewall. It was built to inspect packets, headers and payloads for known-bad structure. A prompt injection is none of those things. It is a grammatically valid, perfectly well-formed piece of English that happens to talk your model into doing something it should not.

The attack surface moved

Your WAF sees a legitimate POST to a legitimate endpoint. Your SIEM sees a normal API call. Neither of them can read. The instruction hidden in the third paragraph of an uploaded PDF is invisible to every control you already own.

The clock moved too

Detect and respond assumes you get time to respond. An agent with tool access does not give you time. It reads, decides and acts inside a single request. By the time an alert fires, the row is already gone.

The bill arrives before the alert

Stolen credentials running inference on your account will burn budget at machine speed while your spend alerts run on a monthly cycle. Most organizations find out from finance, not from security.

It stopped being theoretical

Documented AI-specific security incidents and disclosures, December 2023 to July 2026

1. Dec 2023

   Chevrolet dealership chatbot

   Prompt-injected into agreeing to sell a Tahoe for $1. Never honored, never litigated.

2. Feb 2024

   Moffatt v. Air Canada

   Tribunal rejected the argument that a chatbot is a separate legal entity. The airline owns what its bot says.

3. Jun 2025

   EchoLeak, CVE-2025-32711

   First zero-click prompt injection in a production LLM system. Microsoft 365 Copilot exfiltrated data with no user action.

4. Nov 2025

   GTG-1002 espionage campaign

   AI performed 80 to 90% of a state-sponsored campaign against ~30 targets. Humans intervened at 4 to 6 decision points.

5. Jun 2026

   SearchLeak, CVE-2026-42824

   One-click exfiltration from M365 Copilot Enterprise: email content, OTP and MFA codes, password-reset links.

6. Jun 2026

   Five Eyes joint statement

   Six national cyber agencies: “The timeline is not years, it is months.”

7. Jul 2026

   Indirect injection in the wild

   Two live campaigns using SEO poisoning to instruct browsing agents. Four of 26 tested models executed fraudulent payments.

8. Jul 2026

   JADEPUFFER

   First fully agentic ransomware. Self-corrected a failed login in 31 seconds. Key never transmitted, so paying could not recover the data.

• Incident
• Early warning
• Agency statement

Sources: AI Incident Database #622; Moffatt v. Air Canada 2024 BCCRT 149; Aim Security / Microsoft (EchoLeak); Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign”, 13 Nov 2025;

Varonis Threat Labs (SearchLeak), 15 Jun 2026; Five Eyes cyber agencies, “The AI shift in cyber risk”, 22 Jun 2026; Zscaler ThreatLabz, 2 Jul 2026; Sysdig, 1 Jul 2026.

THE INDUSTRY'S ANSWER, AND WHY IT IS CIRCULAR

Most AI security uses a language model to catch attacks on a language model.

Stop and look at that for a second. If a clever prompt can talk your production model out of its instructions, what exactly stops the same prompt talking the smaller, cheaper model you put in front of it out of its instructions? Every language model shares one weakness: language. A defense built from the same material as the target inherits the target's attack surface. The defense shares the exact weakness of the thing it is defending. You have not added a wall. You have added a second door with the same lock.

The published evidence on using a model to guard a model

Peer-reviewed and preprint findings on the reliability of LLM guardrails, judges and classifiers

• Up to 100%

  evasion success against six production protection systems, including Microsoft Azure Prompt Shield and Meta Prompt Guard, using character injection and adversarial machine learning.

  Hackett et al., Lancaster University and Mindgard. arXiv:2504.11168, LLMSec 2025.

• Near random

  chance. LLM-judge performance degrades to near coin-flip under red-teaming distribution shift, across 6,642 human-verified labels. Many reported attack successes exploit judge inadequacy rather than genuine harm.

  Schwinn et al., TU Munich and Mila. arXiv:2603.06594, February 2026.

• Over 85%

  attack success rate against agentic coding assistants when adaptive strategies are used. Most defense mechanisms achieve under 50% mitigation. The authors conclude the fix has to be architectural, not filtering-based.

  Maloyan and Namiot. Review of 78 studies and 42 attack techniques. arXiv:2601.17548, January 2026.

• Up to 40%

  swing in judge robustness caused by nothing more than the choice of prompt template. Tested 15 attack methods, 7 defenses and 12 models, and found live vulnerabilities in a production deployment.

  Li et al. RobustJudge framework. arXiv:2506.09443, revised November 2025.

This is the whole argument in one line

Every language model shares one weakness: language. Put a model in the enforcement path and the defense inherits the attack surface of the thing it defends.

All four findings are publicly available preprints or conference papers. Titles, authors, venues and identifiers are given above so you can read them yourself. Verified 5 August 2026.

WHAT WE BUILT INSTEAD

Math enforces – AI only advises

AI-Sentinel puts a deterministic engine in the enforcement path and keeps every probabilistic component out of it. Compiled pattern sets, entropy analysis and behavioral heuristics make the call, in Rust, in single-digit milliseconds. The AI oversight tiers watch from the side. They can propose a rule. They cannot ship one.

Two ways to build the enforcement path

The industry default, and the one AI-Sentinel took

The industry default: a model judges the model

• Request

  client
• LLM judge

  probabilistic
• Target model

  probabilistic

Same class of system, same attack surface

Jailbreak the judge with the same technique you would use on the model.

AI-Sentinel: math judges, the model never does

• Request

  client
• T0 deterministic

  compiled RegexSets
• Target model

  probabilistic

Different class of system, no shared attack surface

There is no prompt that talks a regular expression out of matching.

Property	Model-based enforcement	Deterministic enforcement
Can it be jailbroken by a prompt?	Yes, demonstrated in published research	No mechanism for it to be
Same output for the same input?	Not guaranteed	Guaranteed and machine-checkable
Typical added latency	Tens to hundreds of milliseconds	2 to 8 ms measured
Can a human read the reason it blocked?	An inference, after the fact	A rule ID, in the log, at the time

“Jailbroken” claims for model-based enforcement are drawn from the published research listed in the LLM-judge evidence figure. AI-Sentinel latency figures are v6.0 internal benchmarks, June 2026.

13 inspection layers

Ingress and egress. Injection and jailbreak signatures, PII and credential detection, entropy analysis, exponential moving average drift, output redaction and agent tool-call gating.

Written in Rust

16 crates, roughly 205,000 lines. No garbage collector pausing your request path, no global interpreter lock, and tail latency you can actually predict.

A machine-checkable guarantee

Switch every AI tier off and the enforcement engine is provably byte-identical. 1,237 automated tests, 160 of them mapped to specific MITRE ATLAS technique IDs.

Math enforces — AI only advises

AI-Sentinel request lifecycle — deterministic enforcement inline, AI oversight strictly out-of-band

• User / App
  client
• T0
  AI-Sentinel
  ingress pipeline
• Context / RAG
  customer store
• LLM Provider
  untrusted
• T0
  AI-Sentinel
  egress pipeline
• T1–T3 Judges
  advisory only
• The Validator
  deterministic gate
• Audit Chain
  SHA-256, append-only

1. 1

   User / App→Sentinel ingress

   Request · prompt, files, tool calls

   13-layer deterministic inspection — ingress

   • Prompt-injection & jailbreak signatures
   • PII and credential detection
   • Entropy analysis · EMA drift
   • Daily spend ceiling (LLMjacking)
   • Compiled RegexSets — no model sits in the enforcement path
2. ✕

   Sentinel ingress→User / App

   Blocked · deterministic rule ID returned

   fail-fast in 2–4 ms · nothing reaches the model

3. 2

   Sentinel ingress→Context / RAG

   Fetch context

4. ←

   Context / RAG→Sentinel ingress

   Retrieved context

   Your own store is not a trust boundary

   Retrieved documents run the same ingress pipeline. Indirect injection planted in a PDF, ticket or wiki page is inspected before it is ever composed into the prompt.

5. 3

   Sentinel ingress→LLM Provider

   Inspected prompt + context

   Model-agnostic by design

   GPT · Claude · Gemini · open-source · on-prem. The provider itself is treated as untrusted. Swap models without rewriting a single rule — policy travels with your stack, not a vendor.

6. 4

   LLM Provider→Sentinel egress

   Model response

   Deterministic inspection — egress

   • System-prompt / model extraction
   • Data exfiltration & PII leakage
   • Output redaction
   • Agent tool-call and action gating
7. 5

   Sentinel egress→User / App

   Enforced response

   average clean pass under 8 ms · sub-20 ms overhead at any scale

8. 6

   Sentinel egress→Audit Chain

   Decision record: allowed / blocked / redacted + rule ID

9. 7

   Sentinel egress→T1–T3 Judges

   Mirrored copy — out-of-band, non-blocking

10. 8

    T1–T3 Judges→The Validator

    Proposed rule

    evidence, never policy · deterministic validation + human approval

11. 9

    The Validator→Sentinel ingress

    Signed rule hot-swapped into T0 · zero downtime

The Validator is the boss

No rule goes live unless deterministic checks pass and a human approves it. Switch every AI tier off and the enforcement engine is provably byte-identical — 1,237 automated tests, machine-checkable.

T1–T3 sit beside the path, never in it

T1 inline classifier · T2 async analyst · T3 frontier overseer (opt-in, content redacted before transmission). They cannot block. They cannot allow. They cannot write policy. They are untrusted evidence generators — nothing more.

AI-Armory · continuous adversarial validation

Every 30 days, roughly 20,000 adversarial tests mapped to MITRE ATLAS are fired at the live deployment. Findings become candidate rules — which still have to clear the Validator and a human before they enforce anything. The loop closes: protection is proven on a schedule, not assumed between annual audits.

Pilot → Protect → Prove → Pays

Coverage: 100% of applicable MITRE ATLAS pipeline techniques (55 of 55) and 100% of the OWASP LLM Top 10. AI-Sentinel does not claim 100% protection.

Scope: text-layer inspection. OS- and network-layer attack paths sit beneath this pipeline and are out of scope. Latency and test-suite figures are AI-Sentinel v6.0 internal benchmarks, June 2026.

IT IS WHETHER YOU GET DEPLOYED AT ALL.

Security your engineers route around is not security. It is logging.

Ask any platform team what happened to the last security layer that added 300 ms to every response. It got an exemption, then a bypass, then a quiet removal. The only guardrail that protects anything is the one nobody notices.

What a guardrail costs you on every single request

Published latency figures for AI guardrails, against AI-Sentinel's measured overhead

• AI-Sentinel, rejection (fail-fast)AI-Sentinel v6.0 internal benchmark
  3 ms
• AI-Sentinel, average clean passAI-Sentinel v6.0 internal benchmark
  8 ms
• Llama Prompt Guard 2, 22M encoderMeta model card
  19.3 ms
• Azure PII detectionTrueFoundry benchmark, vendor-published
  52.3 ms
• Llama Prompt Guard 2, 86M encoderMeta model card
  92.4 ms
• OpenAI content moderationTrueFoundry benchmark, vendor-published
  191.5 ms
• Prompt-injection detection (Pangea)TrueFoundry benchmark, vendor-published
  358.7 ms
• NVIDIA NeMo, three guardrail railsNVIDIA first-party measurement
  530 ms

0100200300400500 ms

The gap is architectural, not a tuning problem

A 22M-parameter encoder classifier costs about 19 ms. Three stacked model-based rails cost about 530 ms. That is roughly 27 times more, on every request, forever.

Sources: Meta Llama Prompt Guard 2 model cards (86M and 22M); NVIDIA developer blog, “Measuring the Effectiveness and Performance of AI Guardrails”, 3 March 2025 (first-party);

TrueFoundry guardrail benchmark, 19 May 2026 (published by a gateway vendor, not independent); AI-Sentinel v6.0 internal benchmarks, June 2026. Not a like-for-like test: workloads, hardware and tasks differ.

2 to 4 ms

to reject a known attack, using fail-fast logic

Under 8 ms

average clean pass, at any scale

2,000+/s

requests per second per instance

2.2 ms

p99 measured at 200 requests per second

AI-Sentinel v6.0 internal benchmarks, June 2026. We will run them again on your hardware during a pilot, and you can watch.

PROTECTION IS A CLAIM. PROOF IS A SCHEDULE.

Every 30 days - we attack you on purpose.

A penetration test tells you what was true in the week it ran. Models change, prompts change, agents get new tools, and attack techniques change faster than any of them. AI-Armory re-runs roughly 20,000 adversarial tests against your live deployment on a 30-day cycle and hands you the evidence.

Pilot. Protect. Prove. Pays.

How an Onnex engagement actually runs, and what you commit at each step

1. 1

   Pilot

   Monitor mode against your own live traffic. Non-blocking, integrated in minutes.

   You commit nothing

2. 2

   Protect

   Flip to blocking. Deterministic enforcement inline, 2 to 8 ms.

   You commit when the audit convinces you

3. 3

   Prove

   AI-Armory re-attacks the live deployment every 30 days.

   Protection stays evidenced, not assumed

4. 4

   Pays

   Spend ceilings, prompt and context optimization, one platform instead of five.

   The control pays part of its own cost

AI-Sentinel is pre-revenue as of August 2026, with pilots running. No paid customer references are published yet, and none are implied here.

COVERAGE YOU CAN HAND TO AN AUDITOR

One product - not five stitched together.

MITRE ATLAS tactics are the columns and techniques are the blocks. Most products cover a few columns. Buyers end up assembling four or five tools and still land short. We cover 100% of the techniques that a runtime inspection pipeline can address, and we publish which ones it cannot and why.

The two frameworks your auditor will ask about

MITRE ATLAS and the OWASP LLM Top 10, as they stand in August 2026

MITRE ATLAS, release 2026.07 (31 July 2026)

• 16
  tactics
• 178
  techniques
• 101
  parent techniques
• 77
  sub-techniques
• 37
  mitigations
• 68
  case studies

Why “applicable” is the only honest word here

ATLAS covers the full adversary lifecycle, including reconnaissance and attack staging that happen on the attacker's own machine, months before any traffic reaches you. No runtime inspection layer, ours included, can touch those. AI-Sentinel claims 100% of the techniques that are applicable to a runtime pipeline, and states which ones are excluded and why. Any vendor claiming 100% of ATLAS outright has not read ATLAS.

OWASP LLM Top 10 for 2026 (released 3 August 2026)

1. LLM01 Prompt Injection
2. LLM02 Sensitive Information Disclosure
3. LLM03 Excessive Agency
4. LLM04 Supply Chain
5. LLM05 Data and Model Poisoning
6. LLM06 Unbounded Consumption
7. LLM07 Misinformation
8. LLM08 Hidden Context Exposure
9. LLM09 Vector and Embedding Weaknesses
10. LLM10 Improper Output Handling

Prompt injection holds first place for the third year running. Excessive agency climbed from sixth to third, and LLM08 is now hidden context exposure.

Sources: MITRE ATLAS data repository, release 2026.07, 31 July 2026. OWASP GenAI Security Project, LLM Top 10 for 2026, v1.0, released 3 August 2026.

The 2026 OWASP rankings were derived from analysis of around 10,000 real-world AI security incidents rather than expert voting alone.

Read this before you compare vendors

MITRE ATLAS ships monthly content releases and now holds 16 tactics and 178 techniques. The OWASP LLM Top 10 was reissued on 3 August 2026 and the order changed. A coverage percentage with no framework version attached to it is not a claim, it is decoration. Ours is measured against ATLAS release 2026.07 and OWASP LLM Top 10 for 2026.

WHY AN INDEPENDENT STILL MATTERS

Six of the vendors that defined this category are now inside somebody's platform.

Between August 2024 and June 2026 the pure-play AI security firms were bought, one after another, by the large security platforms. That is not a conspiracy. It is a normal market maturing. But it does mean that if you run more than one cloud or more than one model provider, your AI security is increasingly sold to you as a reason to consolidate everything else with the same vendor.

Six of the vendors that defined AI runtime security are now inside a platform

AI-security acquisitions by established vendors, August 2024 to June 2026

Date	Acquirer	AI-security target	Price	Status
Aug 2024	Cisco	Robust Intelligence	undisclosed	Acquired
Apr 2025	Palo Alto Networks	Protect AI	undisclosed	Acquired
May 2025	Tenable	Apex Security	undisclosed	Acquired
Jun 2025	Snyk	Invariant Labs	undisclosed	Acquired
Aug 2025	SentinelOne	Prompt Security	undisclosed	Acquired
Sep 2025	Cato Networks	Aim Security	undisclosed	Acquired
Sep 2025	F5	CalypsoAI	$180M disclosed	Acquired
Sep 2025	CrowdStrike	Pangea	undisclosed	Acquired
Sep 2025	Check Point	Lakera	undisclosed	Acquired
Nov 2025	Zscaler	SPLX	undisclosed	Acquired
Feb 2026	Proofpoint	Acuvity	undisclosed	Acquired
Feb 2026	Check Point	Cyata	undisclosed	Acquired
Feb 2026	Palo Alto Networks	Koi Security	undisclosed	Acquired
Mar 2026	OpenAI	Promptfoo	undisclosed	Acquired
Jun 2026	A10 Networks	TrojAI	undisclosed	Acquired

Still independent as of August 2026

HiddenLayer · Noma Security · WitnessAI · Zenity · Lasso Security · Pillar Security · AI-Sentinel

Sources: acquirer press releases (Cisco, Palo Alto Networks, Tenable, Snyk, SentinelOne, Cato, F5, CrowdStrike, Check Point, Zscaler, A10); Infosecurity Magazine M&A round-ups, Feb and Mar 2026.

Only F5 / CalypsoAI disclosed a price. All other figures reported in the press are estimates and are omitted here. Verified 5 August 2026.

What we will claim

Your policies should travel with your stack and not with your vendor. Swap from GPT to Claude to an open-weight model on your own hardware without rewriting a single rule. That is an architectural property, and it is the one that survives your next procurement cycle.

THE WHOLE COMPANY, IN FIVE POINTS

• AI security is a new discipline - not an extension of the old cybersecurity platform.
• Deterministic security has to come before probabilistic intelligence.
• AI is moving really fast so security without continuous adversarial validation is faith.
• Every organization should be able to afford to protect & prove their AI is safe.
• AI should pay for itself - clear ROI and money saving mechanisms.
• Pilot on your own data, users and setup. Always ‘try before you buy’.

Do not take our word for it. Run it against your own traffic.

Monitor mode goes in non-blocking, in minutes, with zero risk to live workflows. Within days you get a written audit of the prompt injections, extraction attempts and data leaks your current stack is not catching. Then you decide.

The audit is free. The blind spot is not.