Arcjet launches runtime security for production AI agents

Arcjet has launched agent runtime security, a product aimed at engineering and security teams running AI agents in production. The platform covers three areas: observing agent activity, enforcing controls before and after consequential actions, and preserving execution context for security reviews and compliance audits.

Activity can be ingested without application code changes, using existing OpenTelemetry tooling or the Claude Compliance API, and Arcjet links actions across sessions so a run is viewed as one workflow rather than unrelated events. It also builds an inventory of agents and applications operating in an environment.

Enforcement is built on Rego and Open Policy Agent, letting teams write versioned policies through a web UI, API, CLI or MCP without redeploying code. Policies can cap refund values, restrict email recipients and attachments, or limit web fetch tools to trusted URLs, with decisions returned before an action executes so the application can block it, seek human approval or explain the refusal to the agent.

Arcjet said it has native integrations with agent frameworks including the Claude Agents SDK, Claude Managed Agents, OpenAI Agents SDK, LangChain, LangFuse, Strands, Mastra and Microsoft’s Agent Framework. CEO David Mytton said risky outcomes can develop across steps that look reasonable on their own, and that the product connects those steps and applies policy controls at machine speed.