WhiteCircle Is Building the Control Layer for AI

In late 2024, Denis Shilov found a way to break every major AI model.

The jailbreak was remarkably simple. It bypassed the safety systems built into models from OpenAI, Anthropic, Google, Meta, and others, convincing them to generate responses they had been specifically trained to refuse.

Denis published what he’d found. The post went viral. Model companies patched their systems, and Anthropic invited him to privately test upcoming models for similar vulnerabilities.

But the experience left Denis thinking about a larger problem.

Every major AI company was spending enormous amounts of money trying to make its models safe. Yet all of them were trying to solve safety at the model level, with one set of rules meant to work for everyone.

Companies don’t operate that way.

A bank and a video game company shouldn’t have the same policies. Neither should a hospital and a dating app. An enterprise deploying an internal agent may care about entirely different things than a consumer chatbot. And as AI systems move from generating text to taking actions, the consequences of getting those rules wrong become much larger.

Denis started WhiteCircle to build the layer in between.

Every Company Has Different Rules

WhiteCircle gives companies a way to define their own policies for AI and enforce them in real time.

The system sits between an AI application and the models or tools it uses, inspecting what goes in and what comes back. A company can create rules around the things that matter specifically to its business: security, privacy, legal requirements, brand standards, product policies, or actions an agent should never be allowed to take.

That sounds straightforward until you consider the range of systems companies are beginning to deploy.

A customer-support agent might be allowed to issue a refund below a certain amount but require approval above it. A financial application may need to prevent certain recommendations entirely. An internal agent might have access to sensitive information that can be used to answer one employee’s question but should never appear in a response to someone else.

The underlying model can’t know every rule governing every company using it.

WhiteCircle can.

That makes the company less like another model-safety tool and more like a programmable control layer between AI and the world around it.

Safety Has to Move at Machine Speed

The problem gets harder as agents become more capable.

A chatbot produces an answer. An agent can send an email, update a database, execute code, make a purchase, change a customer record, or trigger another piece of software. The surface area for mistakes expands from what the model says to what the system actually does.

Traditional security and compliance systems were built around people and relatively deterministic software. Policies get written in documents. Permissions get encoded into applications. Reviews happen before software is deployed.

Agents operate differently. They interpret context, choose between tools, and make decisions dynamically.

The controls around them have to be able to do the same.

WhiteCircle is building infrastructure that evaluates AI activity as it happens and applies policies before an unsafe output or action reaches the outside world. That creates a separate enforcement layer companies can control without depending entirely on whichever model happens to sit underneath their application.

That independence matters because the models will keep changing.

The rules of the business won’t necessarily change with them.

A Founder Who Started by Breaking the Models

Denis’s path to WhiteCircle makes the company feel unusually natural.

Before starting the company, he had spent years building technical products across AI and other experimental systems, including Phraser and Synthical, and worked at Deepnote. He was the kind of engineer who liked pushing new technologies far enough to discover where they stopped behaving the way their creators expected.

The universal jailbreak made that instinct particularly useful.

Denis wasn’t approaching AI safety as an abstract policy problem. He had demonstrated that the safeguards built into the most sophisticated models in the world could fail, then spent time working directly with one of the leading model companies to understand those failures more deeply.

The company he built reflects that experience. WhiteCircle assumes models will continue getting more capable and that their underlying safeguards will continue improving. It also assumes neither will eliminate the need for companies to control how AI behaves inside their own products and businesses.

Those are different problems.

WhiteCircle is built around the second one.

Denis has since assembled a team with experience across some of the companies closest to modern AI, including HeyGen, Hugging Face, ElevenLabs, and Anthropic red-teaming, alongside deep technical talent from competitive mathematics and engineering.

For a company trying to sit between increasingly capable AI systems and the real world, that is a useful collection of scar tissue.

The Control Plane for AI

The opportunity becomes much larger if AI continues moving from applications into infrastructure.

Today, companies are mostly thinking about individual AI features and agents. Over time, they may operate thousands of intelligent systems across customer support, engineering, finance, sales, operations, and security.

Every one of them will need rules.

Some rules will be universal across the company. Others will belong to a particular product, geography, customer, or workflow. Some actions can happen automatically. Others should require approval. And companies will need to know when policies were triggered, what happened, and why.

That starts to look less like content moderation and more like a control plane.

The analogy we kept coming back to when we invested was Cloudflare. The internet became dramatically more useful as companies gained an independent layer between their applications and the open web, one capable of enforcing security and policy without requiring every application to solve those problems itself.

AI may need something similar.

Model providers will continue building safety into their systems. Application developers will continue adding their own controls. But there is room for an independent layer whose job is to understand the policies of the company deploying the AI and enforce them consistently across whatever models, agents, and applications it chooses to use.

That is the position WhiteCircle is trying to occupy.

Why We Invested

We invested in WhiteCircle because Denis saw the problem from an unusually revealing angle.

He had broken the safety systems of the world’s leading models and then worked closely enough with the technology to understand why model-level safety alone would never solve every company’s problem. The more capable and widely deployed AI becomes, the more businesses will need their own way to decide what these systems can say and do.

We also liked the architecture of the opportunity. WhiteCircle doesn’t require one model company to win. It becomes more useful as companies use more models, deploy more agents, and give those systems more responsibility.

There is still a lot to prove. AI safety is moving quickly, model providers are improving their own controls, and nearly every large security company is thinking about how agents change its market.

But the underlying problem isn’t going away.

AI systems are gaining the ability to act inside businesses and across the internet. Someone has to decide where the boundaries are and enforce them when the software reaches one.

Denis started WhiteCircle after discovering that even the best models could cross those boundaries.

Now he’s building the infrastructure to put them back.

This is the one I’d leave alone after this. The writing still has the qualities that made it our benchmark, but the two shaky biographical claims are gone and the article doesn’t lose anything by removing them.