Arcjet launches runtime security for AI agents in production

Developer security startup Arcjet Labs has launched agent runtime security, a product that tracks what AI agents do once they are running in production. Security teams get an inventory of active agents, and each action an agent takes is checked against policy before it executes, with every run logged for later review.

The company said agents in production can write to databases, answer support tickets and process customer refunds, often starting from an email or a code commit and moving across several systems unchecked. Founder and chief executive David Mytton said a risky outcome can build up over a series of steps that look reasonable on their own.

Agent activity can be fed in through existing OpenTelemetry tooling without code changes, or through Anthropic’s Compliance API for Claude customers. Policies run on Open Policy Agent and can be changed without redeploying the application, covering prompt injection detection, personal data redaction, bot detection and rate limits. Native integrations include the Claude Agent SDK, the OpenAI Agents SDK, LangChain, Mastra and Microsoft’s Agent Framework.

Arcjet also moved its Python and Go SDKs to version 1.0, following the JavaScript and TypeScript SDKs in February. The company says more than 500 production applications now run its software, three years after Mytton founded it, and its backers include Plural, which led an $8.3m Series A last October, along with Andreessen Horowitz, Seedcamp and former Twilio chief technology officer Ott Kaukver.