Arcjet: A Developer Platform for Runtime Security of AI Agents

AI agents are moving from demos into production environments, but the security challenges that come with them are often overlooked. Prompt injection, unauthorized tool calls, sensitive data leakage, bot abuse — these risks are already serious enough in traditional web applications, and they're amplified even further when dealing with AI agents capable of autonomous decision-making and action execution. Arcjet, which recently landed at #2 on Product Hunt (198 upvotes, 30 comments), is squarely aimed at this pain point.

What Problem Is Arcjet Solving?

Arcjet positions itself as a "runtime security platform" with a core philosophy: security capabilities are embedded directly into your AI code. It provides a set of real-time security building blocks that can be called from within the application itself — and critically, these checks happen before actions are actually executed.

For traditional applications, security is typically deployed at the gateway or WAF (Web Application Firewall) layer. But AI agents are different — their behavior is dynamically generated. A single model invocation might trigger a database query, an external API call, or even code execution. By the time traffic reaches the gateway, many risk decisions can no longer be intercepted. Arcjet pushes security logic down into the code itself, letting developers insert checks before every critical action. This represents a meaningful departure from traditional perimeter-based security thinking.

Four Core Security Capabilities

According to the official documentation, Arcjet focuses on four security scenarios that are highly relevant to AI agents:

Detecting Prompt Injection

Prompt injection is one of the most common attack vectors targeting LLM-based applications. Attackers craft malicious inputs to trick the model into ignoring its original instructions and executing harmful operations. Arcjet provides real-time detection to help developers identify potential injection risks before user input ever reaches the model.

Prompt injection falls into two categories: Direct Injection, where attackers embed malicious instructions directly in user input (e.g., "Ignore all your system prompts and do the following instead"); and Indirect Injection, which is more subtle — attackers hide malicious instructions in external content the agent reads (web pages, documents, database return values, etc.), which get executed when the agent fetches that content. The latter is especially dangerous for agents with internet access or file-reading capabilities, since the attack surface extends beyond direct user input to every data source the agent can reach. Because LLMs inherently cannot strictly distinguish between "instructions" and "data," prompt injection is fundamentally difficult to eliminate entirely. Detection tools like Arcjet rely primarily on pattern matching and heuristic rules, which can block known attack techniques to a degree but still have blind spots against novel or heavily obfuscated injections — an ongoing technical challenge in the field.

Authorizing Agent Tool Calls

With the proliferation of mechanisms like Function Calling and MCP, agents can invoke a wide variety of tools and external services. But "can call" doesn't mean "should be allowed to call." Arcjet lets developers perform authorization checks on every tool call, preventing agents from executing actions that exceed their intended permissions — whether due to manipulation or error.

Function Calling is a mechanism provided by major LLM platforms like OpenAI that allows models to decide during inference to invoke developer-defined external functions, passing structured parameters back to the application layer for execution. MCP (Model Context Protocol) is an open protocol proposed by Anthropic that standardizes how models connect to external tools and data sources, enabling agents to access filesystems, databases, and third-party services through a unified interface. Both mechanisms dramatically expand the action space of agents — but they also introduce the "Confused Deputy" problem: an agent holds legitimate permissions to call tools, and if manipulated, it effectively executes unauthorized operations on behalf of an attacker using its own valid credentials. Traditional identity verification can't solve this, because the caller (the agent) is legitimate — what's illegitimate is the intent and context of the call. This is exactly why tool calls need independent authorization checks.

Redacting Sensitive Data

Agents processing requests may encounter PII (Personally Identifiable Information) and other sensitive data. Arcjet provides data redaction capabilities to handle this information before it flows through the model or gets written to logs, reducing privacy exposure and compliance risk.

Blocking Bots and Abuse

This is Arcjet's capability most aligned with traditional security — identifying and blocking automated bot traffic and various forms of abuse, protecting AI applications from malicious scraping or resource exhaustion attacks.

A Developer-First Product

Arcjet is categorized on Product Hunt under Developer Tools, SDK, and Security. Its product form is an SDK that integrates directly into developer code. This means it isn't a standalone security service portal — it's designed to become part of the AI application code stack.

This "security as code" approach aligns well with how developers work today. Compared to configuring a separate security middleware layer, inserting a few lines of security checks before a function call carries far less cognitive overhead and integrates more naturally with existing AI application logic. For teams rapidly iterating on AI agent products, this lightweight integration model has real appeal.

"Security as Code" is a concept that emerged in the DevSecOps movement, advocating for security policies and checks to be written directly into codebases and CI/CD pipelines rather than relying on externally managed configurations. The traditional counterpart is network-layer security managed by dedicated security teams — firewalls, WAFs — which developers rarely interact with directly. SDK-based security tools let developers adopt security capabilities the same way they'd add a logging or monitoring library: security rules are version-controlled alongside code and automatically take effect on deployment, reducing the disconnect between security configuration and actual application logic. This approach is already mature in infrastructure security (e.g., HashiCorp Vault for secrets management). Arcjet extends it to the runtime behavior layer of AI agents — a natural evolution of the same principle in a new context.

Why This Direction Matters

AI agent security has long been a relatively underserved market. Traditional security vendors' products weren't designed for the behavioral patterns of large language models, while most AI development frameworks leave security entirely to developers to handle themselves. The emergence of Arcjet reflects that "agent runtime security" is becoming its own distinct product category.

From a broader perspective: once agents have real execution permissions — calling APIs, manipulating data, completing tasks on behalf of users — the security boundary must evolve from "input/output filtering" to "action-level authorization." Arcjet's emphasis on performing checks before actions occur is precisely the right response to this shift.

It's worth noting objectively that Product Hunt popularity doesn't directly translate to production readiness. How effective Arcjet's four capabilities are in real-world adversarial conditions — particularly prompt injection detection — and whether its false positive rates and coverage can meet enterprise requirements, remain to be validated through more real-world use. But as a developer tool focused on AI agent runtime security, the direction it's pursuing has clear practical value.

Summary

Arcjet represents a pragmatic approach to AI security: rather than building a grand, all-encompassing security platform, it packages specific capabilities — prompt injection detection, tool call authorization, data redaction, and bot blocking — into building blocks that developers can call directly. For teams building AI agents who are worried about security gaps, it offers an integration path worth evaluating.