Arcjet launches custom AI models to secure coding and security agents

The challenge of agent security

AI agents are increasingly being given the power to execute code, access private data, and interact with external systems. While these capabilities make them useful, they also create significant security risks, particularly regarding prompt injection attacks. These occur when an attacker embeds malicious instructions into content that an agent might encounter during its normal workflow.

Attackers can hide these commands in web pages, emails, code repositories, or other external sources. Once an agent processes this content, the hidden instructions can hijack its behavior. This might lead to the agent leaking credentials, modifying source code, or performing unauthorized actions on behalf of the user. Because the agent is designed to follow instructions, it may not distinguish between a legitimate task and a malicious override.

Detecting these attacks is difficult because the same command might be safe in one situation but dangerous in another. For example, a shell command that looks suspicious in a customer support chatbot might be a standard part of a coding agent's job. This lack of context makes it hard for general security tools to provide accurate protection without creating constant false alarms.

Specialized models for specific roles

Arcjet is addressing these context problems by launching a family of custom-trained models. Instead of using a large, general-purpose model to evaluate every single request, they are using compact classifiers. These models are fine-tuned to understand the specific environments in which different types of agents operate, allowing for faster and more accurate security decisions.

The new family includes three distinct models tailored for different use cases. Arcjet Himalia 1 is a general-purpose model for chatbots and AI applications that identifies attempts to manipulate behavior or extract internal info. Arcjet Thebe 1 is designed specifically for coding agents to help them distinguish between real development activity and malicious instructions found in tool outputs or repositories.

The third model, Arcjet Carme 1, is built for autonomous security agents. These agents often analyze vulnerability reports and malicious code, which would normally trigger alarms in standard security systems. Carme 1 is designed to recognize when an instruction is actually trying to leak secrets or weaken security controls rather than just being a part of the agent's analysis work.

How the technology works

The new models are built on the Qwen3-0.6B architecture, which is an open-weight model with 600 million parameters. Arcjet chose this base to create a classification architecture that produces a security verdict without actually generating any text. This approach allows the system to make security decisions in milliseconds, ensuring that the protection happens before an agent executes a potentially harmful action.

To ensure high accuracy, Arcjet fine-tuned these models using a mix of manually reviewed public datasets and their own proprietary data. They tested the models against various types of attacks, including those that were encoded or obfuscated using methods like base64, hexadecimal encoding, or reversed text. The system also uses deterministic decoders to identify known patterns and evaluate the decoded content alongside the original input.

The company also combines these specialized classifications with session-level analysis. This means the system can evaluate suspicious content against the agent's specific assigned task, its previous tool activity, and its history across multiple interactions. This multi-layered approach helps the system identify complex attacks that might unfold over several different turns in a conversation rather than a single prompt.

Performance and availability

Arcjet reported that the Himalia 1 model achieved high performance in evaluations against two public prompt injection datasets. It reached precision scores of 96.9% and 97.8%, with recall scores between 95.8% and 96.4%. These results suggest the model is effective at identifying threats while maintaining a low rate of false positives, which is a primary concern for developers using these tools.

The models are designed to integrate directly into coding agents and custom agents within the code. This allows organizations to get visibility into activities that might not pass through a centralized AI gateway. By providing these guardrails, Arcjet helps teams manage shadow AI and enforce security policies across their entire AI workflows without sacrificing the performance of the agents.

Himalia 1 is currently available to all customers using Arcjet's prompt injection detection through their SDKs. The other two models, Thebe 1 and Carme 1, are currently in early access for organizations specifically building coding or autonomous security agents. Developers interested in these specialized tools can reach out to the company for a free trial or to learn more about the integration.