Arcjet Launches Runtime Security for AI Agents
Arcjet introduces agent runtime security, providing observability, enforcement, and audit capabilities for AI agents operating in production workflows.
Arcjet has launched a new product, agent runtime security, designed to address the growing need for securing artificial intelligence agents as they move from experimental phases into production environments. This solution aims to equip engineering teams with the tools to build and deploy these agents safely, while simultaneously providing security teams with the necessary evidence for governance and compliance.
The core of Arcjet's offering lies in its ability to bring observability, enforcement, and audit capabilities across the entire lifecycle of agent workflows. This allows organizations to identify which AI agents are actively running, establish controls over their actions, and maintain a detailed record of their activities, including the reasons behind specific decisions. As AI agents increasingly perform critical tasks such as interacting with databases, managing support tickets, processing refunds, and calling external tools and APIs, the need for robust security oversight becomes paramount.
These autonomous workflows can be initiated by various events, from chat interfaces and emails to code commits, and can continue across multiple systems without direct human intervention. This autonomy introduces significant security challenges, prompting security teams to answer three fundamental questions: which agents are operating, whether their actions are permissible, and what exactly transpired and why. Arcjet's agent runtime security directly tackles these questions through its three key pillars: observe, enforce, and audit.
The 'Observe' capability focuses on discovering agent activity without requiring extensive application code modifications or the deployment of additional agents. Arcjet supports ingestion of agent activity through existing OpenTelemetry observability tools, enabling real-time visualization and analysis. For users of Claude, the platform can also integrate with the Claude Compliance API. A key feature here is the ability to connect disparate actions across sessions, presenting them as a single, coherent workflow rather than isolated events. This includes detailed tracking of prompts, tool call parameters, session metadata, identity information, and security decisions, providing a comprehensive view of each agent's operations.
With 'Enforce,' Arcjet empowers security teams to define and apply deterministic security policies. These policies can guard against prompt injection, prevent the leakage of Personally Identifiable Information (PII) and sensitive data, detect automation and bot activity, and implement rate limits and quota controls. Leveraging Rego and Open Policy Agent, teams can create and manage versioned policies through a web UI, API, or CLI, without needing to redeploy application code. These policies can restrict agent actions, such as limiting email recipients or refund amounts, or ensuring web fetch tools only access trusted URLs. Arcjet returns decisions to the application before an action is executed, allowing for operations to be stopped, human approval to be sought, or explanations to be provided to the agent.
Integrations with major agent frameworks like Claude Agents SDK, OpenAI Agents SDK, LangChain, and Microsoft's Agent Framework ensure that Arcjet can track recorded actions, their inputs, and policy decisions within the context of the workflow. The 'Audit' function ensures that all execution contexts are collected, enabling teams to reconstruct events, understand policy decisions, and provide irrefutable evidence for security reviews and compliance audits. Correlated traces preserve actions, inputs, security decisions, and policy evaluations, offering a complete audit trail.
"Agents are now taking real actions inside production systems, which means security teams need to know which agents are operating and what they have done, and apply controls at machine speed," said David Mytton, CEO at Arcjet. "A risky outcome can develop across a series of steps that look perfectly reasonable on their own. Arcjet connects those steps and gives teams policy controls to detect them."
Arcjet's approach addresses the evolving threat landscape where AI agents, while offering immense productivity benefits, also introduce new attack vectors. By providing granular control and visibility, Arcjet aims to enable organizations to harness the power of AI agents securely and compliantly.