AI abuse protection

Ship secure agents.
Not security incidents.

Stop bots and automated attacks from burning your AI budget, leaking data, or misusing tools.

1. Run: npx skills add arcjet/skills
2. Add Arcjet protection to my app

1
const aj = arcjet({
2
  rules: [
3
    detectPromptInjection({ ... }), // Block prompt attacks
4
    detectBot({ ... }), // Block automated clients
5
    tokenBucket({ ... }), // Enforce budgets
6
    sensitiveInfo({ ... }), // Prevent data leaks
7
  ],
8
});
9

10
export async function POST(req: Request) {
11
  const decision = await aj.protect(req);
12
  if (decision.isDenied()) {
13
    if (decision.reason.isBot()) {
14
      return new Response(
15
        "Automated clients are not permitted", {
16
          status: 403,
17
        });
18
    }
19
  }
20
  // Arcjet approved
21
  // Now call your AI provider
22
}

Allow trusted traffic. Block AI abuse.

Enforce per-user and per-org AI budgets.

Prevent sensitive data from reaching models and tools.

Python

Available SDKs.

“Arcjet has helped us easily invest in the security and efficiency of our platform”
Chris Ellis
Co-founder & CEO, Thatch

Control AI spend and access

Set AI budgets and access policies

Control who can access AI endpoints and how much they can spend - using identity, route, and session at runtime.

Set AI budgets for users, tenants, and routes.

Treat paid users, admins, agents, and anonymous traffic differently.

Combine multiple limits to stop abusive accounts and cost spikes.

/api/collection

/admin/users

1
const aj = aj.withRules(
2
  tokenBucket({
3
    mode: "LIVE", // Blocks requests. Use "DRY_RUN" to log only
4
    refillRate: 2_000, // Refill 2,000 tokens per hour
5
    interval: "1h",
6
    capacity: 5_000, // Maximum 5,000 tokens in the bucket
7
  }),
8
);
9
export async function POST(req: Request) {
10
  const userId = "user-123"; // Replace with actual user ID
11
  const decision = await aj.protect(req, { userId });
12
  if (decision.isDenied() && decision.isRateLimit()) {
13
    return new Response("AI usage limit exceeded", {
14
      status: 429
15
    });
16
  }
17
  // Handle the request
18
}

Allow trusted bots. Block abusive automation.

Protect expensive AI endpoints from automated traffic, prompt attacks, and cost overruns - without blocking legitimate crawlers, integrations, or users.

Classify well-known bots so you can allow trusted automation.

Protect AI endpoints from automation, prompt jailbreaking attacks, and cost overruns.

Policies live in code and run anywhere your app does. Test locally before deploying.

Block abuse. Control AI spend and access.

Protect expensive AI endpoints from automated traffic, cost attacks, and misuse - while allowing trusted bots, crawlers, and legitimate users.

Block abusive traffic and detect prompt jailbreak attempts before they run up token and tool spend.

Set per-user and per-org AI budgets to control spend across users, tenants, and routes.

Classify well-known bots so you can allow trusted crawlers and integrations without opening the door to abuse.

Open source bot intelligence for AI abuse protection

Arcjet combines open source bot classifications with real-time detection signals, so you can distinguish legitimate automation from traffic that drives up spend or targets AI endpoints.

Visit @arcjet/well-known-bots on GitHub

AI abuse protectionthat ships with your code

Start with code

1. Run: npx skills add arcjet/skills
2. Add Arcjet protection to my app

Ship secure agents.Not security incidents.