What happened
Arcjet says it is launching a family of custom AI security models to analyze agent activity. The first, Himalia 1, is a general-purpose prompt-injection model. It is live in Arcjet’s prompt-injection detection product for every SDK call that uses that detector. Two specialist models are available through early access: Thebe 1, designed for coding agents, and Carme 1, designed for autonomous security agents. The announcement does not state a general release date for those specialist models.
The company describes prompt injection as text that attempts to act as instructions. It distinguishes direct attacks, which come from an agent’s user, from indirect attacks that arrive through external material such as fetched web pages, emails, API responses, or MCP and other tool outputs. The risk it identifies is contextual: an agent that can execute commands, access data, or take actions may do harm if it follows an injected instruction.
Arcjet argues for a separate classifier rather than asking a general-purpose model to assess the attack. Its description says a classifier reads text and returns a label instead of generating prose; the same input yields the same answer, and the company says this kind of model can run in milliseconds on a single GPU. Arcjet also says that putting detection in the application request path lets it inspect requests that might not pass through a platform guardrail or AI gateway. These are the company’s explanation of its approach, not independent comparative measurements.
According to the supplied launch summary, Himalia 1 is a full fine-tune of Qwen3-0.6B with a benign/injection classification head. Arcjet reports F1 scores from 0.964 to 0.971 on two public datasets. It also says the system uses deterministic decoders for encoded attacks before classification and returns a verdict rather than a score. The announcement excerpt explains why Arcjet built its own models: it found licensing constraints, overlapping public datasets with inconsistent labels, and disagreement over what counts as an attack. It does not provide enough detail here to independently assess those claims or reproduce the reported scores. The material gives no price, usage limit, or separate deployment requirements.
What the archive adds
This is a new product event in a topic already covered from other angles. CrowdStrike’s expanded prompt-injection taxonomy catalogued 222 techniques, including attacks on agent planning. A learned attention-gate defense reported reduced adaptive-attack success in a research setting. Arcjet adds a commercial, request-path classifier and specialist variants; it does not establish that these defenses solve the broader problem.
Trend signal
This supports the pattern agent security moves to runtime boundaries: Arcjet places classification in the application request path, where external content can be checked as it enters an agent workflow. The announcement is evidence of a product direction, not proof that a classifier alone is a sufficient security boundary. It says little about permission controls, execution isolation, or how a deployment handles a mistaken verdict.
Why it matters
Agent builders increasingly combine instructions they control with user prompts and content fetched or returned by tools. That makes the trust boundary larger than the chat box: an indirect instruction can arrive inside material the agent was asked to read. A purpose-built classifier offers a distinct layer that teams may evaluate before content reaches an agent or tool workflow.
The useful operational question is not simply whether a vendor reports a high score. Teams need to know how the detector behaves on their own traffic, what it flags incorrectly, what it misses, and what the application does after a verdict. Arcjet’s specialist models also point to an important design choice: the content and risks of coding agents may differ from those of general assistants. But the announcement does not show that the specialist versions outperform a general classifier, nor does it quantify latency or cost against alternatives. Treat the release as a candidate control to test, not a substitute for permissioning and constrained execution.
Limits and uncertainty
The available announcement material reports Arcjet’s F1 range on two public datasets but does not name those datasets in the supplied excerpt, describe their composition, or provide a comparison baseline. It does not establish performance on unseen attacks, encoded or multi-step attacks in production, false-positive rates at a chosen threshold, or behavior across languages and agent frameworks. The source also does not state pricing, volume limits, deployment options, or when Thebe 1 and Carme 1 will leave early access. A deterministic verdict for the same input does not mean the input itself is reliably classified.
Reader takeaway
Himalia 1 is a shipped Arcjet detector component, while its coding-agent and security-agent variants remain early-access offerings. For teams considering it, the next step is an evaluation on representative traffic, including benign content that must not be blocked and adversarial content relevant to their tools. The announcement makes a case for runtime screening, but not for trusting a single classifier as the security boundary.
Open question
How will Arcjet’s specialist models perform on independent, previously unseen agent traffic compared with the general Himalia model and other defenses?