LM-Kit OneThe Private AI Application Server
Promoted
Launching today
Arcjet is the runtime security platform that ships in your AI code. Detect prompt injection, authorize agent tool calls, redact sensitive data, and block bots and abuse. Real-time security building blocks you call inside your app, before an action happens.
Mastra
absolute fan of @davidmytton's work with @Console and @Arcjet.
Their new agent runtime security platform is a must-have for engineering teams to enforce policy the moment an AI agent acts, and keep the evidence to prove what happened and why. Detect prompt injection, authorize agent tool calls, block bots and abuse. It's available now.
Start for free with this prompt or follow the quickstart to protect your first agent tool and LLM calls:
Curious to know what the community thinks about security these days.
Congrats on the launch! How out-of-the-box is the implementation and later use?
Arcjet
Arcjet
@denis_prodan You can implement Arcjet manually - we have language SDKs e.g. JS, Python, Go, as well as direct integrations to AI agent frameworks like Eve, Mastra, LangChain, Google ADK, Claude Managed Agents. But most of our users just install the skill with `npx skills add arcjet/skills` and have their agent implement it!
Does it play nicely with existing observability stacks?
Arcjet
@yangliu44 Yes, Arcjet is focused on AI agent observability, which is necessary for enforcement. We're not trying to replace general observability tools e.g. agent traces, so we work alongside any existing tools you already use.
Is that focused on end users abusing the agent or on agents themselves getting tricked into abusive loops?
Arcjet
Arcjet
@simonclark55 Arcjet can protect both sides - bot detection for web requests like chat UIs, and then tool guards, PII leak detection, and indirect prompt injection detection within the agent workflow (where there is often no web request).
Does it add much latency when you check for prompt injection before every action?
Mastra
@manonbriffaut good question. it adds approximately 100 ms of latency to requests, according to their docs.
Arcjet
@manonbriffaut It depends on the policies you have configured. We run our own models for prompt injection detection so that can take around 100ms to complete the analysis, but for PII detection the p50 is 6ms, and for tool guards it's less than 1ms.
nenspace
any volume increase in security breach attempts you've seen recently and how are you solving them? how do you see runtime security platforms keeping pace?
congrats on the launch! been following you guys for a while love what you're doing
Arcjet
@samsmallmind The biggest challenge I'm hearing from security leaders is how quickly agents are being deployed, and without any visibility from security teams. Going from 30 to 3000 agents within a month is one example - at that volume, there's no way for security teams to keep up unless "security" can be built into agent code from the beginning. That's why I think Arcjet has an interesting advantage because of our native SDKs and AI agent framework integrations.
We split the responsibility so engineers provide the inputs and wrap their agent flows with Arcjet's SDK. Then the security team can independently manage the policies. That prevents one team becoming the bottleneck and allows security teams to work with engineering, rather than blocking them.
Stakpak
I am curious how much more secure this actually makes an AI agent in practice
Arcjet
@noureldin_ehab Arcjet gives you the tools to set up your own policies so you can set up the right level of protections for each agent.
Is there potential for users to accidentally submit PII, like in a support form and medical context? Arcjet can help detect and block.
Does the agent accept user prompts or read from third party sources that could inject attacks? Indirect prompt injection through GitHub issue bodies or website content can be detected through Arcjet's prompt injection protection.
And if the agent calls any tools, the inputs are decided by the agent at runtime. Tool guards add constraints to tools and APIs so they're only called with the expected values.
It really depends on what the agent is doing and where it gets its inputs.