Triage Raises $1.5M to Secure AI-Native Applications

Triage has raised $1.5M in pre-seed funding to build the alignment layer for deployed AI: the infrastructure that preserves an organization's intended behavior after a model leaves its original training context. The round was led by BoxGroup, with participation from Precursor Ventures and notable angels including Zach Lloyd (CEO, Warp.dev), Michael Fertik (Verdict Capital), Bill Shope (Tidal Partners), Niklas de la Motte, and Cory Levy (Z Fellows).

This capital accelerates the two control surfaces at the core of the product: Secure Agents, which derives the minimum environment an agent needs before execution begins, and Integrity, which evaluates the running trajectory and corrects divergence inline. Together they practice what we call defensive interpretability: understanding deployed behavior well enough to steer it, without access to the model's internals.

1. The checkpoint is not the system

A model leaves its provider with documented, evaluated behavior. Almost nothing downstream leaves that behavior untouched. Fine-tuning moves operating boundaries. Quantization decays refusals. Serving stacks change how models act under load. Retrieval shifts the working context, tool integrations grow the action surface, and application code widens exposure. The deployed system is the model plus the application, environment, tools, data, user, and sequence of decisions that produce an outcome.

The research record makes this concrete. Refusal behavior across 13 open-weight chat models, up to 72B parameters, was mediated by a single low-dimensional direction in activation space. One permanent rank-one edit nearly eliminated refusal with under 1% average decline in general capability. Refusal is a mutable access mechanism layered over retained capability, not a durable control boundary.

Inference optimization has the same character. In a recent evaluation of KV-cache quantization across 11 instruction-tuned models, one model lost 15.2% of its baseline refusals while perplexity moved by a factor of 1.03. The metrics infrastructure teams watch barely registered a behavioral collapse, and the failure threshold varied by model. Behavior has to be re-established at the deployment boundary, at the configuration that actually ships.

2. A valid action can become an invalid trajectory

The hardest failures are not single prohibited events. They build from individually plausible steps: several valid operations in the wrong order, a scope of data access that quietly expands, retries that surface information no one intended to expose, a tool call that is authorized in isolation but inconsistent with the original objective. Judged one event at a time, nothing looks wrong. Judged as a sequence, the system has left its intended envelope.

Reasoning traces help but cannot carry the control decision alone. Models frequently omit the decisive drivers of their behavior from stated reasoning, and monitors trained against reasoning can teach concealment. Triage treats reasoning as corroborative evidence alongside observable actions, context, and outcomes. The trajectory carries the verdict.

3. Two moments of control

Secure Agents, before execution

Application code routinely exposes more capability than the task requires: a tool returns whole records when two fields are used, an integration offers dozens of operations when the workflow needs one. Secure Agents analyzes the code paths, tools, data flows, and expected callers around an agent and derives the minimum environment for the intended workflow. If an unnecessary capability never enters the agent's observable environment, the system no longer depends on the model remembering not to use it. The boundary is re-derived as code changes, PR by PR.

Integrity, during execution

Integrity evaluates the full trajectory: input, selected tools, tool arguments, retrieved context, intermediate state, reasoning signals, and output, judged against authored policy and a behavioral baseline learned per deployment. When a trajectory begins to diverge, it applies the least disruptive correction that returns it to an acceptable path: narrowing a query, rewriting tool arguments, substituting a safer tool, retrying with constrained context, requesting confirmation, reducing autonomy, or escalating to a human. Blocking remains available as the final intervention, not the product model.

4. Adaptation without drift

Production systems inevitably change. The question is whether they change through a governed process. Triage converts validated production evidence into updated evaluations, policies, thresholds, and intervention strategies. Every accepted intervention is evidence of intended behavior. Every override marks an assumption that was too tight. Repeated tool sequences establish normal operation.

Every change passes a version gate: reviewed, tested against retained behavior, deployed with rollback. The direct path from live traffic to model weights does not exist. Over time this produces a behavioral dataset grounded in real execution, specific to each tenant, and increasingly precise with every deployment.

5. What comes next

The new funding expands:

• –Cross-model divergence models that require less tenant-specific adaptation.
• –The code-derived exposure engine and the runtime steering plane.
• –Deployment and calibration time, from weeks toward days.
• –Hosted, dedicated, and sovereign deployment surfaces, so the control layer travels with the workload.

6. Work with Triage

Triage partners with teams whose agents take consequential action: systems with access to internal data, tools, and customers. If you need deployed behavior to match declared intent, and to keep matching it as models, providers, and infrastructure change, we should talk.

For pilots, partnerships, or roles, the fastest path is a direct introduction through the site's contact channel.