Arcjet is the runtime security platform that ships in your AI code. Detect prompt injection, authorize agent tool calls, redact sensitive data, and block bots and abuse. Real-time security building blocks you call inside your app, before an action happens.
This is the 3rd launch from Arcjet. View more
Arcjet AI security models
Launched this week
Arcjet is launching a family of custom AI security models designed for analyzing AI agent activity: Arcjet Himalia 1, a general purpose prompt injection model, live today for every SDK call that uses prompt injection detection, and specialist versions designed for situations that general models handle badly, Arcjet Thebe 1 for coding agents, and Arcjet Carme 1, for autonomous security agents.
Launch Team
LoomShow, don't just tell with Loom
Promoted
looks super interesting and relevant to me as a solo founder and for those who uses coding agents - good luck with the launch!
Thanks @withstephen - let me know if you'd like to give it a go so we can help protect your business.
@tessak22 you're the 🐐
@fmerian thanks friend!
Thanks @tessak22 !
yo arcjet, you're one of my favorite devtools
congrats on the launch and bringing more goodness for agents security! 🔥
i'll share this with my builder friends
tiny classifiers for prompt injection is smart, way cheaper than frontier models 🔥 gonna be usefull for coding agents. congrats!
a small classifier giving a verdict in milliseconds instead of sending every tool call to a frontier model is hte only way this works at scale, nobody wants to pay frontier prices just to check each prompt
how do you handle false positives with Thebe 1??? coding agents read so much weird stuff from repos and docs, i'd expect a lot of legit content to look like an injection
Thanks @thamibenjelloun, this is indeed a problem which is why we have a use-case specific model for coding agents and autonomous security agents. When the models detect something suspicious, a secondary decision model evaluates the whole session in context so we can detect whether the prompt could actually cause a risky action. This helps to significantly reduce the number of false positives.
we do browser automation for agents and most injections I see are hidden text in the web page, not in the user prompt. do you scan tool results (page content) before the agent reads them, or only what the user types? and how much latency does it add per tool call?
Yes, @raphael_millet2 , direct prompt injection isn't really that common - it's too obvious. The main threats come from indirect prompt injection through tool results, particularly web pages and third-party APIs. Arcjet scans all the inputs, whether from prompt, tool, or API result.