Company News
Introducing Agent Runtime Security: Observe, Enforce, Audit
Which agents are running? Should this particular action be allowed? What happened, and why? This is what Arcjet is now tackling.
Author
David Mytton
CEO of Arcjet (helping developers protect their apps). Co-Founder of Console (the best tools for developers). Researching sustainable computing at the University of Oxford.
52 posts
AI
The two speeds of AI agent runtime security
AI agent security is moving at two speeds: most teams need action-level runtime enforcement now, while Google’s Beyond Zero points to what comes next.
Changelog
SDK releases, security briefing improvements, new activity view
What's new in Arcjet (2026-07-03). New SDK updates, security briefing email improvements, Nosecone nonce API, and a new Console activity view.
Engineering
Running PII detection locally with the Rampart NER model
How Arcjet added an optional on-device model backend for sensitive information detection: a pluggable rule interface, deterministic recognizers for structured data, offset reconstruction for token-classification output, and local ONNX inference in the request path.
Changelog
SDK performance releases and proxy detection
What's new in Arcjet (2026-06-12). New versions for each of our JS, Python, and Go SDKs to improve performance and detect proxies.
Engineering
Making Arcjet's Wasm bot detector smaller and faster
Reducing WebAssembly bundle size: how Arcjet shrank its Rust bot detector 27% with Aho-Corasick, keeping per-request memory isolation and using Wizer snapshots.
Company News
Announcing advanced bot signals to detect automation without CAPTCHAs
Arcjet Signals are evaluated without a CAPTCHA and enforced when the request passes through a critical flow. The browser gives us signals. The application gives us intent.
Engineering
Designing a CLI for AI agents
How we designed the Arcjet CLI in Go as a stable, defensive interface for humans and AI agents: predictable commands, machine-readable output, strict validation, and confirmation before production changes.
Changelog
Unified skills, Python docs, email management
What's new in Arcjet (2026-05-22). Unified coding agent skills, expanded Python docs, email notification management.
Engineering
Serving AI models with Open Inference Protocol APIs
How Arcjet hosts AI security models using Python, Open Inference Protocol, Go, and Modal: the architecture behind prompt injection detection.
Changelog
Arcjet CLI and team management
What's new in Arcjet (2026-05-15). The Arcjet CLI and team management in the web dashboard.
Engineering
How we defend MCP tool outputs from prompt injection
How we defend Arcjet’s MCP tool outputs from prompt injection by separating trusted guidance from untrusted evidence in structured responses.
Company News
Introducing Arcjet Guards: security inside the agent loop
Arcjet Guards runs security rules inside agent tool handlers, queue consumers, and workflow steps - where proxies and WAFs can't see.
Engineering
Building a production MCP server in Go
How we built Arcjet’s production MCP server in Go: integrating with an existing API, reusing auth and middleware, designing agent tools, and supporting OAuth discovery.
Changelog
Advanced client signals, request filtering, build with agents
What's new in Arcjet (2026-04-24). Advanced client signals for bot detection, request filtering in the Arcjet dashboard and agent-focused documentation.
Engineering
From devcontainers to VMs: parallel dev environments for AI agents
How we replaced a single devcontainer with isolated OrbStack VMs to run multiple parallel development environments for AI agent workflows — architecture, CLI, and tradeoffs.
Changelog
Arcjet MCP server, coding agent plugins, weekly security briefing
What's new in Arcjet (2026-04-17). MCP server, a new AI coding agent plugin for Claude Code and Cursor, and new weekly security briefings via email.
Security
Developers can finally own security
The expertise required to apply security correctly can now live inside the agent, not inside the developer's head or a separate team's backlog.
Company News
Introducing Arcjet AI prompt injection protection
Introducing Arcjet prompt injection detection. Catch hostile instructions before inference. Works with Next.js, Node.js, Flask, FastAPI, and any JavaScript / TypeScript or Python application.
Company News
Arcjet JS SDK v1.0: Stability as a Developer Feature
We’ve just released v1.0 of the Arcjet JavaScript SDK. After more than two years of building, testing, and iterating in public, the SDK is no longer beta. The API is stable, production-ready, and something teams can confidently build on. F
Blog
Arcjet’s 2025: Shipping the Security Developers Actually Use
2025 was a defining year for Arcjet. We made deliberate progress across product, platform, and company, translating a clear focus into meaningful results. Over the course of the year, we delivered substantial improvements to the Arcjet plat
Python
Introducing the Arcjet Python SDK beta
The Arcjet Python SDK allows you to implement rate limiting, bot detection, email validation, and signup spam prevention in FastAPI and Flask style applications.
Engineering
Arcjet's tech stack
The tech stack behind Arcjet: WebAssembly runtimes, a Go gRPC decision API, and region-aware SNS→SQS→ClickHouse pipeline.
Security
Security is just another feature
I recently joined James Governor at RedMonk to talk about why security tooling still feels years behind the rest of the developer ecosystem and what it would take to treat security as just another feature that developers build rather than a
Company News
Introducing Arcjet’s local AI security model + announcing Series A funding
Announcing Arcjet’s local AI security model, an opt-in AI security layer that runs expert security analysis for every request entirely in your environment, alongside our Series A funding.
Security
Introducing Arcjet filters to quickly implement access rules
Arcjet filters let you block requests using expressions over HTTP headers, IP addresses, and other request fields.
AI
How long until we need to block Google?
Google AI Overviews are causing fewer clicks for some site owners. If this is a fundamental shift in the web's traffic economy, how can site owners control where their content appears?
Engineering
How Arcjet approaches open source
How we think about open source licensing, releasing open source projects, forks, and contributing upstream.
Engineering
Arcjet product philosophy: products & primitives
How do you design a security product for developers when they allegedly don't care about security?
Engineering
Devcontainers, Little Snitch, macOS TCC - protecting developer laptops
How we implement different layers to secure our developer laptops & environments: Devcontainers, outbound firewall, macOS Transparency Consent and Control framework, and SSH agent for Git keys.
Engineering
How we run Arcjet like an open source project
Tips and tools for running a devtools startup remotely in 2025. Document everything. Async workflows. Periodic in-person.
Networking
Low latency global routing with AWS Global Accelerator
How Arcjet uses AWS Global Accelerator to route API requests via low-latency private networking to meet our end-to-end p50 latency SLA of 20–30ms.
Go
Building a minimalist web server using the Go standard library + Tailwind CSS
How to build a website with dynamic HTML and a modern UI using Tailwind CSS using only the Go standard library. Embrace the minimalist web server!
Next.js
Nosecone: a library for setting security headers in Next.js, SvelteKit, Node.js, Bun, and Deno
Nosecone is an open source library to set security headers like Content Security Policy (CSP) and HTTP Strict Transport Security (HSTS) on Next.js, SvelteKit, and other JavaScript frameworks using Bun, Deno, or Node.js. Security headers as code.
Blog
Announcing the Arcjet NestJS & Remix adapters
Arcjet security as code adapters for NestJS and Remix.
Engineering
How we achieve our 25ms p95 response time SLA
Local-first security, a low-latency gRPC API in every cloud region, persistent HTTP/2 connections, and smart caching.
Blog
New SDK release for Next.js 15
Support for Next.js 15 with performance improvements and full support for server actions.
WebAssembly
Lessons from running WebAssembly in production with Go & Wazero
Lessons learned from running production Go services that call Wasm using Wazero: embedding Wasm binaries, optimizing startup times, pre-initialization, wasm-opt optimizations, and profiling.
Security
New features to protect your site from AI scrapers and other bots
New bot protection functionality with detection of AI scrapers, bot categories, and an open source list of bot identifiers.
Security
Introducing sensitive information detection & redaction + the Arcjet LangChain integration
Detect, block, and redact PII locally without sending it to the cloud using Arcjet's sensitive information detection, plus the new integration with LangChain.
Company News
Launching the future of developer security + seed funding from a16z
Native security for Next.js, Node.js, Bun, SvelteKit, Vercel, Netlify, Fly.io and other modern platforms. Announcing our seed funding led by Andreessen Horowitz.
Blog
Arcjet changelog 2024-08
Arcjet changelog of product updates for July & August 2024.
Podcast
Podcast: Security is moving to the frontend?!
Discover why we think security is shifting to the frontend in our latest podcast with Snyk advisor Ian Livingstone and Essence VC’s Tim Chen.
Engineering
Minimizing latency for humans & machines
How we utilize AWS Route53, anycast, and multi-cloud to minimize latency and enhance performance for both servers and human users.
WebAssembly
WebAssembly on the server: Compiling Rust to WASM and executing it from Go
Server-side WebAssembly: Unifying cross-language logic for high performance and data privacy. Learn how Arcjet leverages WASM for local-first processing.
Blog
Arcjet changelog 2024-06
Arcjet changelog of product updates for May & June 2024.
Blog
Arcjet changelog 2024-04
Arcjet changelog of product updates for April 2024.
Blog
Arcjet changelog 2024-03
Arcjet changelog of product updates for March 2024.
Engineering
Approaches to keeping doc code samples up to date
Interesting how languages with the highest developer satisfaction are also those that make it easy to write documentation (and tests)!
Engineering
Reviewing AWS ElastiCache Serverless
Reviewing Arcjet's usage of AWS ElastiCache Serverless Redis. Great if you don’t want to think about clusters, nodes and shards, but the pricing is difficult to calculate.
Engineering
Calling Rust FFI libraries from Go
Building and compiling a Rust FFI library so it can be executed from Go.