In the news release, Arcjet Launches Agent Runtime Security for Production AI Agents, issued 17-Sep-2026 by Arcjet over PR Newswire, we are advised by the company that changes have been made. The complete, corrected release follows, with additional details at the end:
Arcjet Launches Agent Runtime Security for Production AI Agents
New product helps teams discover agent activity, apply controls before and after consequential actions, and preserve evidence for security reviews and compliance
SAN FRANCISCO, Sept. 17, 2026 /PRNewswire/ -- Arcjet, the security platform that ships in your AI code, today launched agent runtime security, a new product that helps engineering teams secure the AI agents they are building while giving security teams the governance and compliance evidence they need. Arcjet brings observability, enforcement, and audit capabilities across agent workflows so teams can discover which agents are running, control what they can do, and understand what happened and why.
AI agents are moving beyond chat interfaces and into production workflows, where they can read and write to databases, respond to support tickets, refund payments, call tools and APIs, and take other actions on behalf of users. Those workflows can start from a chat interface, an email, a text message, a code commit, or another event, and can continue autonomously across multiple systems.
As agents take on longer-running workflows, security teams need to answer three questions across the full sequence of activity, which agents are running, whether a particular action should be allowed, and what happened and why.
Arcjet's agent runtime security addresses those questions through observe, enforce, and audit capabilities. Teams can discover agent activity and connect actions across sessions, apply deterministic security policies before and after calls to LLMs, tools, databases, and APIs, and preserve the execution context needed for security reviews and compliance.
"Agents are now taking real actions inside production systems, which means security teams need to know which agents are operating and what they have done, and apply controls at machine speed," said David Mytton, CEO at Arcjet. "A risky outcome can develop across a series of steps that look perfectly reasonable on their own. Arcjet connects those steps and gives teams policy controls to detect them."
Arcjet's agent runtime security centers on three parts of securing agents in production, observe, enforce, and audit.
Observe: Discover all your agents
Arcjet supports ingesting agent activity without application code changes or deploying another agent. Platform and security teams can use existing OpenTelemetry observability tooling to send activity directly to Arcjet for real-time visualization and analysis. For teams using Claude, Arcjet can also pull activity from the Claude Compliance API.
Arcjet connects activity across sessions so teams can see an agent's sequence of actions as one workflow rather than a collection of unrelated events. Activity can include prompts, tool call parameters, session metadata, identity, security decisions, and other application context, giving teams a view of what each agent is doing across a run.
Agent identity and inventory are part of that visibility. Arcjet gives teams an inventory of the agents and applications operating inside their environment, with activity and individual runs associated with each agent so teams can inspect actions and security decisions step by step.
Enforce: Apply controls before and after every action
Once teams can see their agents and activity across sessions, Arcjet lets security teams define controls for prompt injection detection, PII and sensitive information leak prevention and redaction, automation and bot detection, rate limits, and quota controls. Arcjet guards apply deterministic policies to tools, APIs, database calls, and other inputs and outputs. Powered by Rego and Open Policy Agent, teams can create versioned, immutable policies through Arcjet's web UI, API, CLI, or MCP without redeploying application code.
Policies can define the actions an agent is allowed to take, such as restricting recipients or attachments in an email tool, setting acceptable bounds for refund values, or limiting web fetch tools to trusted API URLs. Arcjet returns a decision to the application before the action executes, allowing the application to stop the operation, request human approval, or return an explanation to the agent. Applied before and after calls to LLMs, tools, databases, and APIs, these controls can mitigate risk before consequential actions and verify results before the workflow continues.
For enforcement, Arcjet has native integrations with major agent frameworks, including Claude Agents SDK, Claude Managed Agents, OpenAI Agents SDK, LangChain, LangFuse, Strands, Mastra, and Microsoft's Agent Framework. This in-code context allows Arcjet to track recorded actions, their inputs, and policy decisions across the workflow.
Audit: Evidence and proof of compliance
Arcjet collects the context of each execution so teams can reconstruct what happened, understand why a policy decision was made, and provide evidence for security reviews and compliance audits. Correlated traces preserve actions, inputs, security decisions, and policy evaluations across the workflow rather than leaving teams to piece together isolated events.
Certain controls, including PII detection, execute entirely in-process so sensitive data does not leave the customer environment. Arcjet can store audit data in its cloud, with options for single-tenant and private VPC deployments, or teams can use their own managed storage.
One SDK across JavaScript, Python, and Go
The release also brings Arcjet's JavaScript/TypeScript, Python, and Go SDKs to 1.0, giving teams the same guards, policies, and security tracing regardless of which language they use to build their applications.
Arcjet's JavaScript and TypeScript SDK supports more than 15 frameworks, including Next.js, LangChain, Claude Agent SDK, and OpenAI Agents SDK. Python supports FastAPI, Flask, LangChain, and other frameworks, while Arcjet's framework-agnostic guard API extends protection to MCP servers, background jobs, and other HTTP and non-HTTP code paths.
Together, Arcjet's agent runtime security gives engineering and security teams a common way to see which agents are running, apply policy around consequential actions, and preserve the evidence needed to understand and prove what happened across production AI workflows.
About Arcjet
Arcjet is building the runtime security layer for AI applications, helping developers enforce policy inside the request lifecycle for web endpoints and AI features. Built to integrate directly into modern codebases, Arcjet enables fast-growing teams to embed security into their codebase without sacrificing flexibility. Founded in 2023 by David Mytton, Arcjet is already deployed in 500+ production apps and backed by Plural, Ott Kaukver, Andreessen Horowitz, Seedcamp, and 20+ leading devtools and security angels. https://arcjet.com/
Correction: An earlier version of was missing the last paragraph and the Arcjet boilerplate.
SOURCE Arcjet
Share this article