Arcjet AI security models

A family of custom-trained security models for coding agents

Developer Tools

Artificial Intelligence

Security

Visit WebsiteSee on Product HuntMCP server ⧉

tiny classifiers for prompt injection is smart, way cheaper than frontier models 🔥 gonna be usefull for coding agents. congrats!

The Thebe 1 angle is the one that lands for me. I run coding agents against my own repos all day, and the stuff they read — docs, dependencies, random files — is exactly the kind of content that looks suspicious out of context. A general prompt-injection check would drive me nuts with false blocks, so a specialist model plus that second decision step looking at the whole session before blocking a risky action feels like the right trade-off. One thing I'm curious about: my agents mostly run locally, so does every check round-trip to Arcjet, or can the small classifier run close to the agent?

yo arcjet, you're one of my favorite devtools

congrats on the launch and bringing more goodness for agents security! 🔥

When the small model flags a step and the big model is reading the whole session, does the agent pause and wait, or keep going while that check runs? If it keeps going, a couple of risky calls could land before the verdict comes back.

Arcjet an essential company in the space right now. Excited to try out these models! How did you post-train them out of interest?

Using small classifiers that return a verdict in milliseconds, with a larger model only on suspicious hits, is a sensible split. How often does that second decision step end up running in a typical session?

Super clean approach to AI agent security! Stopping unauthorized actions right at the code level is definitely the way to go
Wishing you all the best with the project!

we do browser automation for agents and most injections I see are hidden text in the web page, not in the user prompt. do you scan tool results (page content) before the agent reads them, or only what the user types? and how much latency does it add per tool call?

How does Thebe handle security tests that deliberately contain prompt injections? Curious how it distinguishes the test data from instructions aimed at the agent.

what happens when the injection gets the agent to write into CLAUDE.md and it only fires next session, does session analysis carry anything across sessions

congrats on the launch. to your question, i would want a plain log of why a request was blocked, so a false positive on a real signup is easy to debug )

looks super interesting and relevant to me as a solo founder and for those who uses coding agents - good luck with the launch!

The distinction between Himalia being live and the specialist models being in preview is useful. Keeping the model version visible with each verdict would help teams compare behavior as those previews develop.

If Himalia flags a prompt injection inside a tool result mid run, does it block just that tool output or kill the whole agent session?

a small classifier giving a verdict in milliseconds instead of sending every tool call to a frontier model is hte only way this works at scale, nobody wants to pay frontier prices just to check each prompt

how do you handle false positives with Thebe 1??? coding agents read so much weird stuff from repos and docs, i'd expect a lot of legit content to look like an injection

Hey team, a huge milestone today! Arcjet Security Models came to change the AI game and I'm truly sure many founders will take the most of it. Keep it up!!!