Silmaril

AI agents like Copilot, Cursor, and ChatGPT increasingly act on public inputs, trusted context, and open web content, and each of these has become an attack surface. The page describes a legitimate microsoft.com link (SearchLeak, CVE-2026-42824) causing silent M365 Copilot data theft including emails, MFA codes, and SharePoint documents without attacker authentication. It also describes hidden instructions in GitHub README comments (CurseChain) causing Cursor to steal SSH keys and regenerate exfiltration code in unrelated projects, and University of Washington research showing a single poisoned web page made ChatGPT Atlas read cross-origin content and submit it to an attacker, with Chrome, Claude for Chrome, and Comet sharing the same attack preconditions. These examples show that conventional permissions and guardrails do not stop multi-step attacks where each individual action looks permitted.

Silmaril is a firewall that wraps an organization's inference calls and evaluates an agent's user intent, tool calls, retrieved context, and accumulated state together to block harmful outcomes before they execute, rather than filtering inputs alone. It integrates via SDKs, agent plugins, frameworks, and AI gateways, covering prompts, tool calls, memory operations, downloads, execution, and data transfers, and can run self-hosted inside a customer's AWS, GCP, or Azure account with tenant isolation and zero token egress. A separate threat-hunting function uses autonomous agents to probe a customer's product, chain prompt injection, tool abuse, and context poisoning into working exploits, and converts each discovered attack into synthetic training data that updates the firewall's defenses in under an hour. The company reports p90 inference latency of about 15ms and p90 end-to-end latency of 50ms, with the SDK failing open by default on infrastructure issues. A typical proof of concept runs four weeks in non-blocking mode on customer-approved internal agents before any blocking policy is considered.

The page frames AI agents as an expanding attack surface across public inputs, trusted context, and the open web, arguing that only adaptive, self-retraining defenses can keep pace with AI-augmented attackers.