Week of Oct 9, 2026 Batch SaaS

Agent prompt-injection runtime defense

Startup Idea Brief Published Week of Oct 9, 2026

A runtime filter that scrubs prompt-injection payloads out of email, web pages, and tool outputs before they reach an agent's context window.

Agents now read inboxes, scrape web pages, parse uploaded documents, and call third-party tools, and every one of those channels is a place an attacker can hide an instruction. This product sits as an inline proxy between an agent's retrieval and tool layers and the model itself. It intercepts untrusted content at the point of ingestion, runs it through a detection and sanitization pipeline, pattern matching, classifier scoring, and structural rewriting that strips or neutralizes embedded directives, and only then lets the cleaned payload reach the context window. It ships as an SDK plus a sidecar proxy that drops into LangGraph, LangChain, CrewAI, and custom agent stacks with a few lines of code.

The buyer is the engineering team shipping an agent that touches untrusted input, inbox assistants, browsing agents, RAG systems over customer-uploaded documents, support agents reading ticket attachments, who need a drop-in control they can point to in a security review without re-architecting their pipeline. The wedge is deliberately narrow: block the payload before it ever reaches the model, not just log that something suspicious happened after the fact.

This is a different bet than the broader AI agent runtime security category, which focuses on observability, tracing every agent decision and scoring outcomes after execution. This product has no dashboards to configure and no eval harness to stand up, it is a single-purpose inline sanitizer, a firewall rule that strips malicious instructions from inbound content before the agent ever sees them. That narrowness is the sale: a security team can deploy it in an afternoon as one control in a larger stack, rather than adopting a new observability platform.

Why Now

Agents have moved from answering questions to taking actions, reading email, browsing the web, and parsing documents, and each of those channels is now a delivery vector for an attacker's instructions. OWASP's two current top-10 lists, for LLMs and for agentic systems separately, both rank prompt injection and excessive agency among the top risks for exactly this reason. The content an agent ingests and the instructions that control it still share a single context window, so there is no equivalent of parameterized queries to separate them structurally, which is why the fix has to happen inline, before that content ever lands in context, rather than through better prompting or output filtering alone.

Demand Signal

MarketsandMarkets sizes the agentic AI security market at $1.65B in 2026 growing to $13.52B by 2032, a 42% CAGR, and documented prompt-injection activity is reported to have risen roughly 340% year over year per CIS threat-intelligence reporting, with about two-thirds of successful attacks going undetected for more than 72 hours. Noma Security closed a $100M Series B in mid-2025 at a reported $400M valuation after ARR grew more than 1,300% in a year, and Y Combinator's Spring 2026 batch includes Silmaril, a runtime firewall built for exactly this problem. Both are signals that investors and buyers already treat inline agent defense as a distinct, fundable line item separate from general AI security platforms.

Defensibility

Every blocked and missed payload becomes a labeled example in a proprietary attack taxonomy, the same kind of compounding asset CrowdStrike demonstrates with its public catalog of over 200 distinct prompt-injection techniques expanded in July 2026. A vendor that accumulates its own attack corpus across customers can tune detection models that a new entrant cannot replicate without the same volume of live production traffic. Inline placement means the product sees every tool call and every piece of retrieved content before the model does, so eval traces from real attacks, not synthetic benchmarks, compound into a detection model that improves per customer-month deployed. Once a security team wires the proxy into CI/CD and incident response runbooks, switching costs rise further, since ripping out an inline control gating production agent traffic is a harder call than swapping a dashboard.

Market Signals

Market sizing: MarketsandMarkets values the agentic AI security market at $1.65B in 2026, reaching $13.52B by 2032 at a 42% CAGR. MarketsandMarkets

Prompt injection volume: CIS threat-intelligence reporting cited a roughly 340% year-over-year rise in documented prompt-injection attempts, with about two-thirds of successful attacks undetected for 72+ hours. Waxell (citing CIS)

Funding validation: Noma Security raised a $100M Series B in 2025 at a reported ~$400M valuation after ARR grew more than 1,300% in a year, backed by Evolution Equity Partners, Ballistic Ventures, and Glilot Capital. fintech.global

Direct competitor signal: YC's Spring 2026 batch includes Silmaril, a runtime firewall that intercepts prompt injections and dangerous tool calls in real time, built for exactly this ingestion-point defense problem. Y Combinator

Standards pressure: OWASP's 2026 LLM Top 10 kept prompt injection at #1 for the third straight year, while its separate Agentic AI Top 10 added goal hijacking, tool misuse, and memory poisoning as new agent-specific risks. SD Times

How I'd Build This

MVP Scope

A proxy and SDK middleware that wraps one agent framework's retrieval and tool-call layer first, LangGraph given its current traction, scanning inbound email, scraped web content, and tool-call outputs for injection patterns with a classifier plus rule-based sanitizer, and either stripping, flagging, or blocking content before it enters the context window. Ship as a lightweight library plus a hosted detection API so teams can start with the SDK and add the full proxy later.

First Customers

Design partners come from teams already building agents with inbox, browsing, or document-ingestion tool calls, found in LangChain and LangGraph Discord and GitHub discussions, AI agent security subreddits, and YC's own agent and AI-safety batch alumni who need a defense layer but are not building one themselves. Security engineering leads at companies running support or RAG agents over uploaded documents are a second channel, reachable through OWASP's LLM and Agentic AI working groups and AI security conference talks such as DEF CON AI Village and BSides AI tracks.

Moat Sequence

First, ship accurate detection for the highest-volume channels, email and scraped web content, to get design partners live and generating traffic. Second, build the attack taxonomy and eval-trace pipeline from real blocked and missed payloads across customers, the same compounding data asset CrowdStrike demonstrates with its 200-plus technique catalog. Third, once the taxonomy is deep, layer in per-customer tunable inline controls, policy rules and allow and block lists, that make switching costs real.

90-Day Timeline

Zero to 90 days: ship the SDK and proxy MVP for one agent framework and land three to five design partners from agent-builder communities. Ninety days to six months: expand coverage to two more ingestion channels, documents and tool outputs, formalize the attack taxonomy from production data, and convert design partners into paid pilots.

Building in this space?

I've taken an agentic AI product from first build to acquisition. If you're exploring this idea or one close to it, a 30-minute call is a good place to pressure-test it.

Book a 30-min call

Sources

AI Agent Security trend page Agentic AI Security Market Report Noma Security secures $100M funding Silmaril (Y Combinator) CrowdStrike uncovers new prompt injection techniques Prompt Injection tops 2026 OWASP GenAI/LLM Top Ten CIS prompt injection 340% enterprise AI risk