Arcjet has launched agent runtime security, a product intended to help engineering teams secure the AI agents they are building while giving security teams the governance and compliance evidence they need, the company said. It spans observability, enforcement and audit across agent workflows.
The observe element is meant to let teams find out which agents are running. Arcjet said it can take in agent activity without application code changes or the deployment of a further agent, and that platform and security teams can send activity through existing OpenTelemetry tooling for real-time visualisation and analysis. For teams using Claude, activity can also be pulled from the Claude Compliance API. Activity is connected across sessions so that a sequence of actions appears as a single workflow, and Arcjet provides an inventory of the agents and applications in an environment, with runs tied to each agent.
Under enforce, security teams can define controls for prompt injection detection, prevention and redaction of PII and sensitive information leaks, automation and bot detection, rate limits and quotas. Arcjet said the guards apply deterministic policies to tools, APIs, database calls and other inputs and outputs, and are built on Rego and Open Policy Agent, with versioned, immutable policies created through a web UI, API, CLI or MCP without redeploying application code. A decision is returned to the application before an action executes, so the application can stop the operation, seek human approval or return an explanation to the agent. Arcjet lists native integrations with the Claude Agents SDK, Claude Managed Agents, the OpenAI Agents SDK, LangChain, LangFuse, Strands, Mastra and Microsoft's Agent Framework.
For audit, Arcjet said it collects the context of each execution so teams can reconstruct what happened, understand why a policy decision was made and provide evidence for security reviews and compliance audits. Correlated traces hold actions, inputs, security decisions and policy evaluations across the workflow. Some controls, including PII detection, run in-process so sensitive data does not leave the customer environment, and audit data can be stored in Arcjet's cloud, in single-tenant or private VPC deployments, or in a team's own managed storage.
The company also said its JavaScript and TypeScript, Python and Go SDKs have reached 1.0, giving teams the same guards, policies and security tracing whichever language they use. David Mytton, Arcjet's chief executive, said agents are now taking real actions inside production systems, so security teams need to know which agents are operating and what they have done, and to apply controls at machine speed. He said a risky outcome can develop across a series of steps that look reasonable on their own, and that Arcjet connects those steps and provides policy controls to detect them.
