Exclusive: Arcjet launches runtime security to track and control AI agents in production

Developer security startup Arcjet Labs Inc. has introduced agent runtime security, a new feature that monitors and controls AI agents once they are deployed in production systems. The solution provides developers with a list of active agents and enables security teams to review each action an agent performs before it takes place.

Arcjet ensures that every run is logged for future analysis. The company's focus lies in addressing the growing challenge of managing AI agents that extend beyond chat interfaces, now capable of interacting with databases, handling support tickets, and processing customer refunds, among other tasks. According to the company's founder and CEO David Mytton, a single risky step can accumulate over a series of seemingly harmless actions.

Arcjet consolidates these steps and offers policy controls that operate at a pace faster than machines. To integrate Arcjet, platform teams can utilize existing OpenTelemetry tooling, or they can leverage Anthropic PBC's Compliance API for Claude customers. The platform stitches together prompts, tool-call parameters, and security decisions from individual sessions into a single workflow per agent, allowing investigators to dissect each action meticulously.

Security teams can configure rules to detect prompt injection or automatically redact sensitive information, preventing data leakage. Additionally, the company provides bot detection and rate limiting capabilities. Policies are managed using Open Policy Agent and can be modified without redeploying the application, enabling teams to enforce limits on the monetary value of refunds without waiting for a software update.

Each policy check occurs before an action is executed, and the application can either halt the call, request human approval, or provide an explanation to the agent. Post-execution, Arcjet verifies the results to ensure compliance. The company offers native integrations with popular AI agent SDKs such as Claude Agent SDK, OpenAI Agents SDK, LangChain, Mastra, and Microsoft's Agent Framework.

For auditors, Arcjet maintains a record of correlated traces, documenting actions, inputs, and policy evaluations for each execution. Certain controls, including personal data detection, run entirely within the customer's environment, ensuring data remains within their own system. Customers can choose to store audit records in Arcjet's cloud, a single-tenant or private cloud deployment, or their own storage solution.

The release also marks the launch of version 1.0 for Arcjet's Python and Go SDKs. The JavaScript and TypeScript SDK reached version 1.0 in February and now supports over 15 frameworks, including Next.js. A separate guard interface, independent of any framework, extends coverage to background jobs and other code, including processes that do not interact via web requests.

Arcjet reports that more than 500 production applications currently use its software, three years after its inception. The company's investors include Plural, which led an $8.3 million Series A round in October 2021, as well as Andreessen Horowitz, Seedcamp, and former Twilio CTO Ott Kaukver.