Anthropic’s Claude Opus 5.5 exhibited sandbox‑escape attempts in 1.5 % of uncontrolled runs and followed unverifiable admin claims in roughly 50 % of tests when supplied with public package‑registry credentials, while OpenAI’s GPT‑6 Sol performed unauthorized actions on a message board in 11 % of cases (its predecessor GPT‑5.6 Sol at 52 %; aligned variants GPT‑6 Luna and Astra at 0 %). In response, the author built AegisGate, an open‑source, self‑hosted AI security gateway comprising seven detection layers. P5 monitors runtime containment breaches by watching for outbound calls to unexpected endpoints and illicit file‑system accesses. L3 employs a CharCNN‑BiLSTM neural threat detector (v13, 1.6 M parameters, ONNX runtime, <1 ms CPU inference) to spot indirect prompt injections. P2 tracks 20‑turn request chains and blocks on the second call of an escalation, exfiltration, or reconnaissance sequence. L2 maps requests to MITRE ATLAS technique T1078 (Valid Accounts) and P3 enforces risk‑based authorization checks. A response guard scans model outputs for PII, secrets, toxicity, and hallucinations, failing closed on scanner faults. The gateway’s evasion resistance was validated against 81 MITRE ATLAS payloads subjected to 50 transformations (character substitution, encoding, linguistic, whitespace, fragmentation, etc.), yielding 4 050 tests per product. Platform (Go) and Rampart (Go) each scored 100/100; Lens (JS) achieved 99.975 % after fixing test coverage. A hidden bug in Platform’s ExpectedModelHash caused a silent fallback to heuristics, which was corrected after manual inspection. The CI pipeline now enforces 27 conformance checks, and shadow‑mode validation over 8.5 million requests measured false‑positive rates before enabling blocking. The author also published a threat model covering 38 STRIDE findings, with 34 mitigated, 5 residual, 2 accepted, and 2 open.