HiltLock is an AI red teaming firm. We attack production generative AI systems the way an adversary would and report every finding with reproduction steps, focusing on authorisation failures rather than content failures: whether an authorised model can be talked into acting outside its authority. Cross-tenant data exposure, prompt injection that survives guardrails, agent and tool-use chains, model supply chain. Where a finding comes from the model's own behaviour and cannot be closed in code, we also build a runtime policy gateway the customer configures and owns.