Arcjet is runtime security for AI agents. Identity tells you who is asking but not what happens next, so Arcjet puts the decision where the action is. It runs inside your application code and through coding agent hooks to observe every agent action, enforce policy before the action executes, and keep each decision as evidence. Teams use Arcjet to block prompt injection, stop PII leaks, cap token spend, block bots, and secure coding agents like Claude Code, Codex, Copilot, and Cursor, with no gateway, proxy, or sidecar to run.