Arcjet

Your AI agents are authenticated. That doesn't mean they're under control. Last week I spoke with five security leaders - at a bank, a retailer, a manufacturer, a hospital network, and a consumer internet company - about how they secure the AI agents running inside their businesses. At the same time I was reading Google's "Beyond Zero," its vision for enterprise security in the AI era. World models are the future, but that's not where most people can start. The application is the wrong place to make the decision - the individual action is the right level of granularity. Not "can this agent use the ERP," but "should this payment, for this amount, to this account, based on this invoice, happen right now." Three common objections: 1. "It runs on behalf of the user." That proves authority, not intent. The agent inherits the user's full standing permissions - everything they might do over months - to complete one task now. If a malicious document or prompt redirects it, it uses that legitimate authority for something the user never asked for. 2. "It's locked down with least privilege." Necessary, but static. An email agent is allowed to send email - the risk is the recipient and the attachment. A payment agent is allowed to transact - the risk is the amount and the account. Those facts only exist at runtime, after the permission check has already passed. 3. "We already do fine-grained authorization with a policy engine." Maybe you do, and a good policy language helps, but a policy engine only decides well if you feed it the action, its arguments, and the surrounding context, at the moment the action fires, inside the application. That last-mile enforcement is usually the bit that doesn't exist yet. Google's answer is a machine-speed reasoning engine on top of an enterprise-wide "world model." Very cool - who doesn't want to build this?! But it's a Google-scale build. The five leaders I spoke with weren't close to that. They couldn't reliably see every agent they were running, or confirm the same controls existed across teams. They need the floor first - see the action, enforce a policy, stop it when needed, record the decision. Two speeds, one direction: - Where it's going: dynamic, context-aware decisions across a whole session. - What's needed now: consistent enforcement on the actions that move money, expose data, or call tools. And no, the network is not where this is going to be solved. Visibility (telemetry) + enforcement (in the code) is what we're building at Arcjet.

In AI security, the prompt is just the start. Defenders need correlated workflows — not isolated events — to understand #AI actions, enforce policy and stop risky behavior in real time, says Arcjet's David Mytton in this op-ed. #cybersecurity #infosec #CISO

Your firewall sees a request. It doesn't see the refund your AI agent is about to issue, the file it's about to read, or the model budget it's about to burn. That's the gap in perimeter security once agents enter the picture. The request looks fine. The action isn't. Arcjet is the runtime security platform that ships with your code. Enforcement runs inline, with identity, session, route, and spend context no proxy or gateway can see, and the decision happens before your app continues. In practice that means you can: - Stop prompt injection before it reaches the model - Enforce per-user budgets so automated abuse can't torch your AI spend - Keep sensitive data from leaking through prompts, tool outputs, and file reads - Protect the tool and action boundary, not just the front door Best part: you don't wire it up by hand. Point your coding agent at Arcjet and it adds framework-native SDK code and verifies the integration. Works across Next.js, NestJS, Express, SvelteKit, FastAPI, Flask, and more. Security that lives where your logic lives. Take a look: arcjet.com

Arcjet is joining the new edition of the Gemini Startup Forum: Cybersecurity. 33 AI startups working on security, plus specialists from Google Cloud Security and Google DeepMind: we'll be there at Google London in September. https://goo.gle/4vfbEc5

Big news for the Arcjet team: we're one of 33 startups in Google's first Gemini Startup Forum: Cybersecurity cohort, it's an entire program focused on AI-native security, with roadmap input from Google DeepMind and Google Cloud. Hard to think of a better room to be in right now.

A human-friendly CLI can rely on judgment. An agent-facing CLI needs stronger guarantees: stable command shapes, parseable output, strict validation, and no ambiguity around production changes. We made some specific design choices for the Arcjet CLI: - Treating commands and flags as an API contract - Returning structured JSON errors and distinct exit codes - Validating inputs before any network call - Requiring an explicit confirmation protocol for mutations - Designing the CLI to work alongside MCP, not replace it More details: https://lnkd.in/eQ-rT7V8

Unified coding agent skills, enhanced Python documentation, and email notification management. A tidy week of cleanups in our changelog this week! https://lnkd.in/gJxxBZXE

We’ve started hosting AI models at Arcjet for security features like prompt injection detection. Open Inference Protocol gives us a standard API between them so each model service can be deployed as a FastAPI ASGI app hosted on Modal. Python wraps the model because that’s where the AI ecosystem lives. Our internal core remains Go for everything else. And our customers can call it through native building blocks in our JS and Python SDKs. OIP has been great to work with. Check out the latest blog for the technical details.

In agent workflows, JSON is not just data. It becomes model context. That means fields like summary, reason, and suggestedActions can become part of the prompt surface. Here are the patterns we use in Arcjet’s MCP server: separating trusted guidance from untrusted evidence, using structured output schemas, and testing that attacker-controlled text never crosses into fields an agent may treat as instructions. Read our latest blog post for details!

Today we're releasing Arcjet Guards to add security in AI applications where WAFs and CDN firewalls can't see.   AI applications are increasingly built around long-running agent workflows that execute outside the HTTP request lifecycle. A support agent reads an incoming ticket, looks up the customer in your CRM, summarizes account history with an LLM, drafts a reply. Where does the WAF or CDN firewall fit into that flow? It doesn't.   Guards is our answer - runtime policy enforcement for the agent tools doing the work. It plugs into the same Arcjet SDK already used to protect their chat UI, so the controls extend cleanly from the front door to the agents behind it.   1) A webpage your agent fetched contains hidden instructions telling it to email your customer list to an attacker - Guards detects the prompt injection before that content re-enters the model's context.  2) A runaway agent loop burns $8,000 in model spend overnight - Guards enforces per-user token budgets inside the loop itself.  3) A background job ships support tickets to a third-party LLM for summarization - Guards blocks personally identifiable information (emails, card numbers, etc) before the message leaves your system.   We also tried something different with the launch. Instead of writing detailed documentation for developers, we put it all in a skill for AI coding agents. Point your coding agent at it, tell it what you need to protect, and it has everything it needs to implement Guards.   Get started with your JS or Python applications: npx skills add arcjet/skills --skill add-guard-protection