TrueFoundry Integrates HiddenLayer Runtime Security Into Its AI Gateway

TrueFoundry has integrated HiddenLayer Runtime Security into its AI Gateway, giving organizations a single place to enforce security policies across every large language model that passes through the gateway. The announcement, published July 15, 2026, addresses a growing operational problem: development teams want rapid access to new models, while security teams need consistent protection against prompt injection, jailbreaks, and data leakage without having to rebuild integrations for each provider.

Under the new integration, HiddenLayer runs as a lightweight wrapper that the TrueFoundry AI Gateway calls on both the inbound prompt and the outbound response. HiddenLayer evaluates the content against configured policies and returns a clear verdict — Allow, Block, or Redact — which the gateway then enforces. Malicious or non-compliant requests can be stopped before they reach the model, and sensitive information can be redacted in place. Policies are managed centrally in HiddenLayer’s AISec Platform Console and apply automatically to any model routed through the gateway.

“Every team shipping AI right now is living the same contradiction,” wrote Rishiraj Dutta Gupta of TrueFoundry. “Developers want to wire up new models as soon as they appear. Security teams need every prompt and every response to be safe, compliant, and free of leaked data. Both are right, and neither can wait for the other.”

The integration is positioned as a way to make runtime AI security closer to a configuration step than a multi-month engineering project, while still giving security teams centralized control and a complete audit trail across models and environments.

Conditions Driving the Event

• Development teams are rapidly adding new large language models from multiple providers, creating a growing sprawl of models that each require their own security integrations if protected individually.

• Security teams face increasing pressure to block prompt injection, jailbreak attempts, and sensitive data leakage in real time, but cannot keep rebuilding protections every time a new model is introduced.

• Most organizations currently enforce AI security at the model or application level rather than at a shared gateway, leaving gaps whenever a new provider or model is added outside the original security design.

• Runtime protection has become a higher priority as more AI systems move from experimentation into production workflows that handle real customer data and business decisions.

• Centralized policy management is now preferred over per-model engineering because it allows security rules to be updated once and applied consistently across every model without code changes.

• Low-latency enforcement is required so that security checks do not introduce noticeable delays that slow down developer workflows or end-user applications.

• Auditability has become essential: security and compliance teams need a complete record of every prompt, response, and policy decision across all models and environments.

• Shadow and unsanctioned model usage continues to expand inside enterprises, increasing the risk that unprotected models are called without any runtime controls in place.

• Existing AI gateway platforms have focused primarily on routing, cost control, and observability, leaving a clear opening for deeper runtime security capabilities.

• Organizations want security that feels closer to a configuration switch than a multi-month engineering project, reducing friction between speed of adoption and strength of protection.

• The combination of multi-model access and rising regulatory and internal risk pressure has made single-point runtime enforcement a practical necessity rather than a nice-to-have feature.

What AI Security Looked Like Before

Before integrations of the kind TrueFoundry and HiddenLayer have just announced, runtime security for large language models was almost always fragmented and reactive. Most organizations handled protection in one of three incomplete ways. Some embedded security checks directly inside individual applications, which meant every new application or team had to re-implement the same controls. Others relied on the native safety features offered by each model provider, which created inconsistent coverage across OpenAI, Anthropic, Google, open-source models, and smaller specialist providers. A third group used standalone security tools that required separate SDKs or proxies for every model endpoint, turning security into a continuous integration project rather than a one-time control.

This approach produced several predictable problems. Policy updates were slow and expensive. Changing a prompt-injection rule or a sensitive-data redaction pattern usually required code changes, testing, and redeployment for each integration. Security teams frequently lagged behind development teams that wanted to try new models as soon as they became available. Coverage was uneven: some high-visibility applications received strong runtime protection while experimental or secondary models ran with little or no inspection. Audit trails were scattered across different systems or missing entirely, making it difficult to answer basic questions about what had been allowed or blocked across the full set of models in use.

As organizations increased the number of models they called, the operational burden grew rather than shrank. Every new provider or version introduced a new potential gap. Shadow usage made the problem worse, because models reached through personal accounts or unofficial endpoints often sat completely outside the security perimeter. In practice, the more aggressively a company adopted multi-model AI, the harder it became to maintain a coherent security posture. Runtime protection remained a per-model engineering task instead of a shared infrastructure capability.

What AI Security Looks Like Now

The TrueFoundry–HiddenLayer integration illustrates a clearer and more scalable pattern that is beginning to take hold: runtime security is moving up the stack into the AI gateway layer. Instead of securing each model individually, organizations can now place a single enforcement point in front of every model they use. HiddenLayer Runtime Security sits inside the TrueFoundry AI Gateway and inspects both the inbound prompt and the outbound response against centrally defined policies. It returns a simple verdict — Allow, Block, or Redact — that the gateway enforces immediately, before the request reaches the model or before the response returns to the application.

This architecture changes the economics and the speed of security. Policies for prompt injection, jailbreak attempts, and sensitive data exposure are defined once in HiddenLayer’s console and automatically apply to every model routed through the gateway. Adding a new model no longer requires a new security integration; the model simply inherits the existing controls. Security teams gain a unified policy surface and a complete audit trail across all models and environments. Development teams continue to call models through a single API with only minimal added latency, so the friction between speed of adoption and strength of protection is reduced.

The broader shift is from “secure each model” to “secure the path to every model.” Organizations that adopt gateway-level runtime enforcement can expand their model portfolio more quickly without creating new unprotected surfaces. Policy changes can be made centrally and take effect immediately rather than waiting for code releases. Auditability improves because every decision is recorded in one place. While this pattern does not eliminate the need for strong model-level and application-level controls, it provides the missing shared layer that most multi-model environments have lacked. The companies that implement it early will be able to move faster while keeping a consistent security baseline across an increasingly complex set of AI systems.