Arcjet AI security models

About Arcjet AI security models

Arcjet AI security models are a family of custom-trained classifiers built to analyze AI agent activity at runtime. The lineup includes Arcjet Himalia 1, a general-purpose prompt injection model shipping now, alongside two specialist previews: Arcjet Thebe 1 for coding agents and Arcjet Carme 1 for autonomous security agents. These models are compact classifiers fine-tuned from Qwen 3-0.6B, designed to return a verdict in milliseconds.

Review

Arcjet's security models slot directly into the Arcjet runtime security platform, which ships inside application code. The SDK calls these models before an action happens-detecting prompt injection, authorizing tool calls, or redacting sensitive data. The new model family layers specialized detection on top of the existing platform, with one general model available now and two specialist variants in early preview.

Key Features

• Custom-trained prompt injection classifier (Himalia 1). A general-purpose model that detects prompt injection attempts on every SDK call using prompt injection detection. It's live and running on the platform today.
• Specialist models for coding and security agents (Thebe 1, Carme 1). Two models built for scenarios where general models produce too many false positives. Thebe 1 targets coding agents, while Carme 1 targets autonomous security agents. Both are in early preview.
• Two-stage decision process. When the first-line model flags a potential injection, a secondary decision model runs with a larger context window. It examines the whole session-previous activities and the agent's next intended action-before blocking or allowing it.
• Ongoing session analysis. Each action is assessed individually and within the broader session context. This lets the system detect agent behavior changes over time, blocking risky actions like credential exfiltration or unsafe code execution that surface later in a session.
• Configurable data retention. The SDK returns a decision with a reason, so developers can see what triggered a block. The platform can optionally retain prompts for historic evaluation, with customizable retention policies that include a zero data retention option.

Pricing and Value

Pricing for Arcjet AI security models is not yet defined in the available reference content. The underlying models are described as compact classifiers that run inference at a fraction of the cost of querying a frontier model. The models execute on Arcjet's cloud infrastructure, deployed across Cloudflare's edge network with over 300 locations worldwide. The platform manages scaling and inference, and the team updates the models with new data regularly.

Pros

• Specialist models address a known gap: general-purpose prompt injection detection frequently misfires on coding agents that read documentation, dependency files, and other benign but unusual-looking content.
• The secondary decision model reviews full session context before acting, which reduces the chance of blocking legitimate activity based on a single out-of-context input.
• Session-level analysis tracks behavior shifts over time, catching delayed attacks that a single-prompt check would miss.
• Zero data retention is available as an option, which matters for teams with strict data handling requirements.
• Inference runs on Cloudflare's edge network, keeping latency low across a broad geographic footprint.

Cons

• Two of the three models-Thebe 1 and Carme 1-are in early preview, so their real-world performance and stability aren't yet established.
• All inference runs in Arcjet's cloud; there's no local or on-device execution path for agents that operate entirely offline or in air-gapped environments.
• The tool is not well suited for teams that need a standalone, self-hosted classifier they can run independently of the Arcjet platform.

Arcjet AI security models fit best with teams already building on the Arcjet runtime platform who need prompt injection detection that adapts to specific agent types. The specialist models, once they move past preview, could serve coding agent developers who find general classifiers too noisy, and security agent builders who need tighter analysis of autonomous tool use. Anyone evaluating this should weigh the preview status of Thebe 1 and Carme 1 against the immediate availability of Himalia 1 and the platform's existing detection capabilities.