Arcjet has added prompt injection protection to its runtime security engine, designed to detect and block malicious instructions before they reach an embedded AI model.
The protection runs inside a WebAssembly-based policy engine and integrates with JavaScript and Python frameworks including Next.js, LangChain, and the Vercel AI SDK. It slots into the existing Arcjet request lifecycle alongside bot detection, rate limiting, and sensitive data detection rules.
The initial release covers a fairly broad range of attack types: jailbreaks, prompt-extraction attempts, shell injections, encoding attacks, and structural exploits like ChatML injection. The goal is to catch attempts to override application behavior, expose hidden system prompts, or extract data at the point of the request rather than discovering the problem later through log analysis.
Under the hood, Arcjet uses a purpose-trained LLM to classify incoming prompts. The added latency is roughly 100-200ms, and pricing is $2 per 1 million tokens.
Code examples for Next.js with the Vercel AI SDK and Python FastAPI with LangChain are available in the Arcjet docs.

Collections

Arcjet has released prompt injection protection integrated into its WebAssembly-based runtime security engine. It detects and blocks malicious AI prompt attacks — including jailbreaks, prompt extraction, shell injections, encoding attacks, and ChatML injection — before they reach an embedded AI model. The feature uses a purpose-trained LLM classifier, adds roughly 100-200ms latency, and is priced at $2 per 1 million tokens. It integrates with JavaScript and Python frameworks such as Next.js, LangChain, and the Vercel AI SDK, slotting into Arcjet's existing request lifecycle alongside bot detection and rate limiting.

Arcjet adds AI prompt injection protection to its runtime policy engine