The control plane for AI agents
Hyperion decides what each of your agents is allowed to do — deny by default, on every tool call — and writes a signed record of every decision. Threat detection on the prompt comes with it. Any model, any framework.
Edit the prompt or pick an example, then run detection.
This demo runs Hyperion's real rule and pattern libraries — the same regular expressions, severities, token format and response schema as the platform — locally in your browser. The hosted API additionally runs three machine-learning classifiers (injection, jailbreak similarity, toxicity) that cannot ship to a browser, so toxicity is marked as not run here.
The gap
Agents now handle support conversations, move money, touch HR records, and execute code. The controls that exist for every other kind of production software — access control, audit logs, policy engines, incident response — were never built for them.
Every existing tool owns one slice of this — injection detection, or output validation, or offline evaluation, or infrastructure metrics. The buyer needs one place to look, with one audit trail behind it.
The platform
Catch threats in the request path, before they reach your agent or your model.
Decide what each agent may do — and route the rest to a human.
Explain what happened, to the person who has to answer for it.
Status is stated plainly. Layer 1 is built and benchmarked. Most of Layer 2 shipped across August 2026 — tool permissions, approvals and signed audit on the 19th, an operator dashboard on the 22nd, and the agent registry with shadow-agent detection on the 23rd. Roles, SSO, rate limits and no-code policy authoring are not built. Layer 3 is still roadmap, apart from the audit views already live. We would rather you knew exactly which is which.
Layer 2 · try it
Detection reads the prompt. This reads the action. Every tool your agent wants to call is checked against an allowlist held on our server — not in a config file the agent could edit. Anything not on the list is refused, and a request goes to a human instead of a hard failure.
Held per tenant, agent and tool, enforced by the database.
Everything absent from this list is denied.
Pick a tool call above. Three are approved; the rest are not.
Same decision logic and response shape as the live endpoint — {decision, approval_request_id},
deny-by-default, and a repeated denial reuses its pending request rather than filling the queue with
duplicates. In the real platform an operator approves from the dashboard, the policy row is granted in the
same transaction, and every line above — including the approval itself — is written to a signed audit trail.
Architecture
The usual objection to a cloud governance tool is that it means shipping your customers' personal data to a third party. Hyperion removes that objection architecturally rather than contractually: the SDK finds and tokenises PII inside your own process, before the first network call. We only ever receive tokens.
No proxy to stand up, no agent rewrite, no model change. Add the call where user input enters your agent, and hand the masked prompt onward.
# pip install hyperion-sdk
import hyperion
client = hyperion.Client(
api_key="hp_live_...",
agent_defaults={
"payments-bot": {"on_unavailable": "block"},
"faq-bot": {"on_unavailable": "allow"},
},
)
result = client.detect(
prompt=user_input,
agent_id="payments-bot",
config={"block_on": ["INJECTION", "JAILBREAK", "SECRETS"]},
)
if result.blocked:
return "I can't help with that request."
# PII is already tokenised — your agent never sees it either
answer = my_agent.run(result.masked_prompt)
# Swap the real values back in, locally
return client.detokenize(answer, session_id=result.session_id)Benchmarks
A detection vendor that cannot measure itself is selling a feeling. Every figure below comes from a benchmark run committed alongside the code, stamped with the commit that produced it, and re-run on every detector change.
| Detector | Corpus | Recall | False positives | Notes |
|---|---|---|---|---|
| Jailbreak | JailbreakBench, 50 attacks | 100% | 0% | Every category: malware, fraud, harassment, economic harm |
| Secrets | AWS · GitHub · Stripe · Slack · JWT · private keys | 100% | 0% | Format matching plus Shannon entropy analysis |
| PII | Synthetic, 8 entity types | 100% | 20% | Recall prioritised over precision by design — see below |
| Prompt injection | OWASP LLM Top 10, 28 attacks | 100% | 0% | Reached 100% on 14 Aug 2026 — character-substitution obfuscation is now normalised before classification |
| Toxicity | Detoxify eval set | 75% | 0% | Off-the-shelf classifier; being replaced in Phase 1b |
Hyperion deliberately over-detects PII rather than under-detects it. A wrongly tokenised date costs a tokenisation round trip. A missed national insurance number costs a regulatory disclosure. We publish the number rather than tuning it out of sight.
False positives. The injection classifier can flag a benign support message as an attack at high confidence. Two fixes were tried and reverted because each cost us the block rate. It needs model-level work, and until then we would run a pilot with that detector in log-only mode.
Latency. Detectors now run in separate processes, which removes the contention that caused our old p99. We have not re-measured it on hardware big enough to run five real models, so we are not publishing a number yet.
A governance product is a claim about discipline. We keep a public register of every known gap in our own platform, severity-rated, and each one must be closed or formally re-accepted before a customer goes live. That register existed before anyone asked to see it.
Deployment
| Hyperion Cloud | Self-hosted | |
|---|---|---|
| Built for | Startups and scale-ups with no appetite for infrastructure work | Finance, healthcare, government, and anyone with a data residency mandate |
| Time to first call | Minutes — an API key and one SDK call | Hours — Helm chart or Docker Compose |
| Where PII lives | Your infrastructure. Tokenised before it leaves your process. | Your infrastructure. Never transmitted anywhere at all. |
| Where audit logs live | Hyperion, queryable by API and dashboard — tokens only | Your database. You own the data outright. |
| Updates | Continuous, managed by us | Versioned releases on your schedule; signed offline bundles for air-gapped sites |
| Commercials | Usage-based, plus seats for the governance console | Annual licence and support |
| Availability | Available now | Phase 3 — see roadmap |
OpenAI, Anthropic, Google, Mistral, Llama, Azure OpenAI, or an endpoint you host yourself. Hyperion inspects the traffic, not the vendor.
LangChain, LlamaIndex, CrewAI, AutoGen, OpenAI Assistants, or a bespoke loop. No integration is a prerequisite for another.
The platform has been containerised since its first commit, so the image running in our cloud is the image that runs in your VPC. Self-hosted is not a fork.
Who it is for
Wants to ship. Governance is a blocker, not a goal. Gets a one-line SDK call and keeps moving.
Has agents in production with no visibility and no controls. Gets detection, enforcement, and forensics.
Cannot demonstrate to a regulator how personal data is handled. Gets a signed, queryable audit trail.
Runs many agents across teams, each governed differently. Gets one policy layer across all of them.
Roadmap
Verify p99 on hardware that can run five real models. Fix the benign false-positive at the classifier level. Self-serve tenant onboarding. Deploy the production pipeline to real infrastructure. Publish the SDK. Onboard the first three design partners onto live traffic.
Shipped across August 2026: per-agent tool permissions, the approval queue, signed tool audit and the cost-avoided metric (19 Aug); an operator dashboard for all of it (22 Aug); the agent registry, shadow-agent detection and agent-scoped API keys (23 Aug). Still to come: visual policy authoring, Slack and email approval routing, roles and SSO, argument-level tool authorisation, and multi-agent trace propagation.
Per-agent anomaly baselines, automatic incident summaries, one-click compliance evidence packs, the full platform as a Helm chart inside your VPC, air-gapped model updates, and OpenTelemetry export.
SOC 2 Type II, HIPAA business associate agreements, a FedRAMP path, native SIEM integrations, custom organisation-specific detectors, and a contractual uptime commitment.
We are looking for three teams running agents in production — ideally where an agent already touches customer data or takes consequential actions. You get the platform free through Phase 2, direct access to the people building it, and influence over what gets built next. We get real traffic, real threat data, and a reference.
Prefer email? Write to contact@hyperion-ai.dev.
Agent governance is a category forming right now, and no incumbent owns it. The existing vendors each hold one slice — injection detection, output validation, offline evaluation, infrastructure metrics — while the buyer needs a single place to look with one audit trail behind it.
Prefer email? Write to contact@hyperion-ai.dev.