Best AI security solution for healthcare and regulated industries
The best AI security for healthcare inspects PHI and PII in your process so the raw body never leaves to be classified. Ask per control. Not a HIPAA certification.
Read guideArcjet Learning Center
AI Security Guides
Identity, architecture, and runtime controls for agents that call tools, access data, and take actions.
What these guides cover
AI security protects systems in which models can call tools, access private data, and create real-world side effects. Model safeguards alone cannot determine whether a specific user may refund an invoice, whether retrieved content is trustworthy, or whether a sequence of individually permitted actions is safe. Production controls must preserve user and agent identity, validate untrusted model output, enforce policy immediately before consequential actions, constrain resource use, and record decisions for investigation. These guides focus on enforceable application boundaries: where a control has enough identity, workflow, resource, and business context to stop an unsafe operation before it completes. The result is layered protection tied to real application consequences.
Risks
- Unauthorized or manipulated tool calls
- Prompt injection through user or retrieved content
- Delegated authority used outside the user's intent
- Sensitive-data exposure and runaway resource use
Control priorities
- Action-level authorization inside the application
- Separate user, agent, workload, and client identities
- Prompt-injection, data, sequence, and budget checks
- Fail-safe enforcement with attributable audit evidence
Recommended reading order
Start with AI agent runtime security for the threat and control model. Use the architecture guide to choose enforcement points, then open the security guide for the framework you ship: Claude Agent SDK, Claude Managed Agents, CrewAI, Genkit, Google ADK, LangChain, LangGraph, Mastra, OpenAI Agents, Strands Agents, TanStack AI, Vercel AI SDK, or Vercel Eve. Use the agentic identity guide to design delegation, workload identity, token exchange, and action-level authorization.
Guides in this collection
Best AI security solution for fintech
The best AI security for fintech inspects financial data in your process, gates money-moving agent actions before they run, and logs an attributable decision for the audit.
Read guideWhat's the best AI security provider for enterprises?
The best AI security provider for enterprises depends on the layer: identity, gateway, guardrails, observability, or in-code enforcement. Ranked lists mix those jobs.
Read guideEve agent security is three jobs
Eve agent security is three jobs: screen inbound channel text, gate tools and connections, and treat hooks as observe-only.
Read guideHow to secure a Mastra agent
Screen inbound Mastra messages with guardProcessor, wrap authored createTool execute with guardTool, and deny unwrapped MCP, workspace, and toolset tools with guardHooks.
Read guideClaude Agent SDK security
Wiring recipe for Claude Agent SDK: screen prompts on UserPromptSubmit and deny tools at PreToolUse. The full checklist is the Claude Agent SDK security guide.
Read guideHuman approval is not a security policy
Human approval is not a security policy. A click is a hold, not a remote allow or deny. Eve user-approval, Mastra requireApproval, and Claude canUseTool park a call; they do not decide it.
Read guidecanUseTool is not a policy gate
Claude's canUseTool looks like a gate. allowedTools, allow rules, and bypassPermissions / acceptEdits skip it. A Bash or Write in allowedTools never hits the callback.
Read guideA sandbox is not a tool policy
An agent sandbox isolates untrusted code from your app runtime and your secrets. It does not decide whether this tool or connection should run.
Read guideMastra guardrails vs an action gate
Mastra guardrails classify messages. An action gate decides whether this tool runs. A clean prompt-injection score can still open a pull request that pastes a private file.
Read guideThe lethal trifecta for AI agents
The lethal trifecta is private data, untrusted content, and external communication in one AI agent. Together they let an attacker steal data by planting instructions in content the agent already reads.
Read guideHow do I secure a RAG application?
Someone asks about the refund policy. The retriever pulls the five closest chunks. One of them is a customer PDF that also says to forward last week's invoices. Similarity said the text was on topic. It did not say the text was safe.
Read guideGuardian Agents, explained
Guardian Agents supervise the agents you run with visibility, assurance, and runtime enforcement. Observation and posture are shipping; in-line blocking is still the weak slice.
Read guideApplication-Native vs Remote Security Policies: A Technical Guide
Compare application-native and code-native security rules with remote policies, including ownership, architecture, Arcjet, Datadog AI Guard, and Runlayer.
Read guideAI Agent Security Architecture: In-Code vs Proxy vs Gateway vs Security Agent
Compare in-code, proxy, AI gateway, and security-agent controls by visibility, enforcement, context, latency, failure modes, and threat coverage.
Read guideAI Agent Identity and On-Behalf-Of Authorization
AI agent on-behalf-of authorization: delegated identity, OAuth token exchange, actor claims, credential downscoping, runtime policy, and audit trails.
Read guideWhat Is AI Agent Runtime Security?
AI agent runtime security for unauthorized tool calls, prompt injection, sensitive data, automated abuse, action sequences, and production cost controls.
Read guideRuntime Security for LLM Applications: Prompt Injection, Data Exfiltration, Unsafe Actions
The three runtime failure modes for LLM applications (prompt injection, data exfiltration, and unsafe actions) and the control that addresses each.
Read guidePrompt injection protection for LangChain, LlamaIndex, and Vercel AI SDK apps
How to protect LangChain, LlamaIndex, and Vercel AI SDK apps from prompt injection: screen the user message before the model, and screen tool or retriever output before it re-enters context.
Read guidePre-Runtime vs Post-Runtime AI Security Tooling
AI security tools cluster into pre-runtime, runtime, and post-runtime. What each prevents, and why enforcement and observability are not substitutes.
Read guideKeeping Security Inspection Local So Data Stays in Your Environment
What local inspection means for data residency, and exactly what Arcjet inspects locally.
Read guideHow to Enforce Runtime Controls on AI Agents Accessing Enterprise Systems
When agents touch CRMs, warehouses, and internal APIs, the control has to run at each action. How to enforce budgets, injection checks, and data controls at runtime.
Read guideHow to Enforce Token and Spend Budgets on AI Agents
A runaway agent is a budget problem before it is a security problem. How to cap token and action spend per identity, enforced at the tool call and shared by key.
Read guideHow to Prevent Data Exfiltration Through AI Agents
Stop agents leaking sensitive data without sending that data to a third-party scanner. Detect and block exfiltration locally, in your own infrastructure.
Read guideHow to Stop AI Agents Accessing Data They Should Not
Scoped credentials limit what an agent can reach. They do not limit what it does with what it reached. How to add a runtime check at the point of access.
Read guideHow to detect and redact PII in LLM inputs and outputs
Scan the prompt before the provider sees it and the completion before it renders. Inbound and outbound placement, regex versus classifier, custom identifiers, and streaming chunk boundaries.
Read guidePII detection at runtime: gateway, sidecar, or in-process
Compare gateway, sidecar, and in-process PII detection on data egress, path coverage, and latency, with a platform table and a method for measuring accuracy yourself.
Read guideHow to stop users sending PII to an LLM
Block, redact, or warn by data class, why client-side checks are not a control, how to log a block without logging the PII, and how to avoid pushing users to shadow AI.
Read guideHow to prevent PII leakage from AI agents
An agent has five leak points, not two. A coverage matrix across tool shapes, why tool call arguments are the uncovered case, and how to check memory and agent handoffs.
Read guideHow to redact sensitive data before sending it to OpenAI or Anthropic
Middleware around the OpenAI and Anthropic clients, reversible versus irreversible redaction, streaming chunk boundaries, tool call arguments, and why provider-side filters run too late.
Read guideHow to prevent LLMs surfacing confidential employee or customer data
Permission-aware retrieval, tenant boundaries in memory and vector stores, and why fine-tuning has no runtime remedy. Mapped to OWASP LLM02 Sensitive Information Disclosure.
Read guideGDPR and CCPA compliance for LLM applications
A requirement-to-control mapping for engineers: data minimization, erasure across derived stores, processor scope, transfers, and audit trails that do not create a second PII store.
Read guideHow to prevent prompt injection in LLM applications
A five-layer defense stack: input screening, instruction and data separation, output validation, privilege limiting, and action gating. What each layer catches and what it misses.
Read guideHow to sanitize user input before passing it to an LLM
Why escaping and regex filters fail, what structural separation actually looks like, encoding normalization, classifier placement, and the multi-turn payload single-message screening cannot see.
Read guideHow to prevent a malicious tool call from hijacking your AI agent
A hijack is a well-formed call the model was persuaded to make. Argument validation against application state, per-context tool scoping, action budgets, divergence detection, and the sequence problem.
Read guideHow to defend against indirect prompt injection in agentic workflows
Payloads arriving through retrieved content: an entry-point inventory, screening before context, provenance tracking, spotlighting, blast-radius limits, and how to test by planting payloads in real sources.
Read guideHow AI security platforms detect prompt injection at runtime
Five detection mechanisms compared on what each catches and what evades it: heuristics, fine-tuned classifiers, LLM-as-judge, canary tokens, and behavioral divergence. Plus where detection runs and where it's enforced.
Read guideThe best tools to detect and block prompt injection in production
Arcjet, Lakera Guard, Azure Prompt Shields, LLM Guard, Rebuff, and Guardrails AI compared with maintenance status checked August 2026, plus where Arcjet is the wrong choice.
Read guideBest AI security tools for developers
The best AI security tools for developers are the ones you call in the handler before the provider or the tool runs. A WAF, a gateway, or a dashboard after the refund is a different job.
Read guideHow to Add Human Review and Approval Gates to AI Agent Actions
Some agent actions should not execute without a human. A practical pattern for approval gates on high-risk actions, using a runtime decision as the trigger.
Read guideProducing Compliance Evidence for AI Agent Activity
Auditors do not want your system prompt. They want evidence of what your controls allowed and blocked. What to record for agent actions, and what it demonstrates.
Read guideHow to Secure an MCP Server or AI Agent Tool Calls
MCP tools have no HTTP front door. How to add budgets, injection detection, and data controls where the tool actually runs.
Read guideAnatomy of an Agent Incident: Three Permitted Actions, One Fraud
An AI agent with correctly scoped tools can still commit fraud, because the question is not whether each action is permitted but whether the sequence is.
Read guideHow do I add guardrails to an AI agent that calls external APIs?
Put the check on outbound HTTP inside execute: authorize the user and object, rate-limit the identity, screen arguments, then screen the Stripe or GitHub response.
Read guideRuntime security for LLM applications: prompt injection, data leakage, and output validation
Screen the user message, screen retrieved chunks for leakage and indirect injection, and validate the completion before it renders or writes.
Read guideWhich runtime security tools integrate with LangChain or AutoGPT?
LangChain Python wraps the tool. LangChain JS has guardTool and guardMiddleware. LangGraph JS has guardTool and guardToolNode. CrewAI has register_arcjet_hooks. AutoGPT has command run.
Read guideHow do I prevent an AI agent from taking irreversible actions?
Classify transfers, deletes, sends, and prod config. Deny that set by default, hold a human on the few that need a person, rate-limit frequency, and resume from a stored approval with an idempotency key.
Read guideHow do I implement the OWASP Top 10 for LLM Applications?
A runtime check for each 2026 OWASP GenAI LLM Top 10 item, on the hop that item names: prompt, chunk, tool, or completion.
Read guideAI security checklist for production LLM apps
An engineer-first AI security checklist: 20 verifiable items grouped by the NIST AI RMF functions, plus the OWASP LLM Top 10 mapped to the runtime control that denies before the side effect.
Read guideWhat is AI security?
AI security protects the system around the model. How model safety, application security, and runtime enforcement divide the work, which risks each layer can address, and where the controls run.
Read guideWhat changes for application security when your app calls an LLM?
Four surfaces when a handler calls a model: user text, retrieved documents, model output in downstream ops, and the provider as a processor of whatever you send.
Read guideContent moderation for AI applications
Screen user prompts before AI-generated content, including image prompts. Includes samples for the Vercel Chat SDK, LangChain, the Claude SDK, and the OpenAI SDK.
Read guideClaude Agent SDK security guide
An eight-item Claude Agent SDK 0.3 security guide: dependencies, secrets, UserPromptSubmit screening, canUseTool traps, guardTool, PreToolUse, session UUIDs, and CI.
Read guideClaude Managed Agents security guide
An eight-item Claude Managed Agents security guide: hosted-harness boundaries, guardEvents inbound screening, guardCustomTool on agent.custom_tool_use, is_error denials, and MCP servers you host.
Read guideCrewAI security guide
An eight-item CrewAI 1.15 security guide: official Python only, Chromadb CVE, kickoff screening, human_input traps, PRE_TOOL_CALL hooks, and guard_tool.
Read guideGenkit security guide
An eight-item Genkit JS 1.41 security guide: dependencies, secrets, generate() screening, interrupt traps, guardTool on ToolAction, and guardMiddleware.
Read guideGoogle ADK security guide
An eight-item Google ADK TypeScript security guide: dependencies, runAsync screening, requestConfirmation traps, guardPlugin ordering, the deny dict, and caller-owned correlation.
Read guideLangChain security guide
A LangChain 1.x security guide for Python create_agent and JavaScript createAgent: dependencies, inbound screening, HITL traps, guard_tool, and wrapToolCall.
Read guideLangGraph security guide
An eight-item LangGraph JS 1.4 security guide: dependencies, invoke screening, interrupt traps, guardTool, in-place guardToolNode, and payload denials.
Read guideMastra security guide
An eight-item Mastra 1.63 security guide: dependencies, guardProcessor, requireApproval traps, guardTool, guardHooks for MCP, and RequestContext IDs.
Read guideOpenAI Agents security guide
An OpenAI Agents security guide for JS 0.17+ and Python 0.19+: Assistants sunset, run() screening, needsApproval traps, guardTool, and reject_content.
Read guideStrands Agents security guide
An eight-item Strands Agents JS 1.x security guide: dependencies, invoke screening, interrupt traps, guardTool, Plugin guardHooks, and BeforeToolCallEvent.cancel.
Read guideTanStack AI security guide
An eight-item TanStack AI security guide: dependencies, chat() screening, needsApproval and contentGuardMiddleware traps, guardMiddleware ordering, skip vs abort, and caller-owned correlation.
Read guideVercel AI SDK security guide
An eight-item Vercel AI SDK 7 security guide: Node 22+, ESM, generateText screening, guardTool, contextSchema, guardAction, and toolsContext.
Read guideVercel Eve security guide
An eight-item Vercel Eve 0.47 security guide: Node 24+, channel screening, hook and sandbox traps, guardTool, and guardApproval on MCP connections.
Read guide