HiddenLayer Funding Signals AI Agent Security Shift

HiddenLayer has raised $100 million in a Series B round as the security market around AI systems expands from protecting models to governing the agents, tools, and workflows built on top of them. The Austin-based company told TechCrunch that its annual recurring revenue grew more than tenfold over the past year and now sits in the tens of millions of dollars.

The round, led by Delta-v Capital with participation from Ten Eleven Ventures, Morgan Stanley, Microsoft’s M12, Booz Allen Hamilton, and others, is a useful market signal. Enterprises are no longer treating an AI deployment as a single model endpoint. They are beginning to see it as a live software supply chain with identities, plugins, tool calls, runtime behavior, and failure modes that need continuous control.

From model defense to agent runtime security

HiddenLayer started by protecting machine-learning models from adversarial attacks and vulnerabilities. Its current scope includes discovery, runtime protection, attack simulation, and supply-chain security for models, agents, and workflows. CEO Chris Sestito said the company has extended those capabilities to address prompt injection, agent manipulation, and malicious tool use rather than abandoning its earlier technology.

That distinction matters. An agent can be compromised without the underlying model being “hacked” in the traditional sense. A malicious document can steer an agent through prompt injection. A tool can return attacker-controlled content. A permission that looked harmless in a chatbot can become consequential when the system can send email, modify records, spend money, or call production APIs.

TechCrunch reported that HiddenLayer’s customers include financial-services companies, large technology firms, and government organizations. The company says it also works with a leading frontier-model provider and has contracts with the Department of Defense and the intelligence community. Gartner estimates that companies will spend $2.83 billion this year on products intended to secure AI tools, an 83% increase over 2025.

The overlooked attack surface is the tool chain

The most important part of the announcement is not the funding number. It is the shift in what counts as an AI security boundary. HiddenLayer says it scans roughly 50 AI file frameworks to detect cases where an open-weight model is not what it claims to be, including hidden models embedded inside other models. That is a supply-chain problem, not merely a prompt-quality problem.

For agent builders, the equivalent supply chain includes system prompts, skills, MCP servers, npm and Python packages, browser automation components, connectors, retrieved documents, and the credentials exposed to tools. Any of these can change the behavior of an otherwise trusted workflow. A model registry or package repository is therefore not enough. Teams need provenance, integrity checks, version pinning, and a way to revoke a component without taking the entire automation stack offline.

This is also why “agent observability” cannot stop at token usage and latency. A useful security trace should show which identity initiated a run, which model version was selected, which context entered the prompt, which tool was called, what arguments were passed, what the tool returned, and which policy allowed the next step. Without that chain, an incident review becomes guesswork.

Governance is becoming infrastructure

Sestito expects AI infrastructure to grow toward discovery, identity, and policy controls. That prediction is more consequential than any individual product feature because it describes a control-plane layer for agentic software. The industry is converging on a practical question: can an organization know which agents exist, what they can reach, and whether their behavior is still inside an approved envelope?

A robust implementation should separate four decisions that are often collapsed into one model call. First, discovery determines which agent or workflow is running. Second, identity determines who owns it and which credentials it may use. Third, policy evaluates whether a requested action is permitted in the current context. Fourth, runtime enforcement blocks or approves the actual tool call. The language model can propose an action, but it should not be the final authority that grants itself access.

n8n Lab has also examined why local AI agents need stronger data boundaries. For n8n and similar automation environments, this means putting deterministic gates around high-impact nodes and external requests. Require approval before irreversible actions. Restrict tools by workflow identity rather than by a shared credential. Log inputs and outputs at the boundary where data leaves the system. Add timeouts, budgets, replay protection, and circuit breakers for agents that can loop or retry. Test prompt-injection and tool-confusion scenarios as part of deployment, not only after an incident.

What builders should do now

The funding round suggests that AI security is moving from a specialist concern to a standard production layer. Builders should inventory every agent and connector, including experiments that were launched outside the central platform. Next, classify tools by blast radius: read-only retrieval is not equivalent to sending money, changing a CRM record, or deploying code.

Then create a model-independent authorization layer. A fallback model should inherit the same permissions, approval rules, and data boundaries as the primary model. Provider switching must not silently widen access. Store evaluation traces and security events together so a migration can be tested for both quality and risk.

The final step is supply-chain hygiene. Pin versions, verify packages and model artifacts, review skills and connectors, and treat retrieved content as untrusted input. The fastest way to make an agent reliable is not to make it more autonomous. It is to make every consequential transition visible, bounded, and reversible.

Key takeaway: HiddenLayer’s round reflects a wider change in AI infrastructure: the security boundary is moving from the model endpoint to the complete agent runtime. Production systems need discovery, identity, policy, supply-chain checks, and deterministic tool enforcement around every model.