Arcjet Guards: When AI Agents Bypass Every Perimeter Defense

An AI agent draining $8,000 in LLM token budget overnight is not a billing anomaly — it is a security failure that no web application firewall was positioned to catch. Traditional WAFs sit at the HTTP boundary. Agents operate inside it: they read files, process queue messages, call external tools, and accumulate context across multi-step pipelines without ever presenting a request object to a perimeter control. Arcjet’s Guards, announced April 30, 2026, moves enforcement to the function-call boundary where agent behavior actually lives.

The Attack Surface That Moved Inside

The WAF model assumed a legible perimeter — every meaningful interaction crossing a front door that could be inspected, rate-limited, and filtered. That assumption held for decades. Agents broke it.

When an agent fetches a webpage, processes the content, and passes a summarized result back into the model’s context window, no HTTP perimeter sees the interaction between steps. Hostile instructions embedded in a fetched page — prompt injection — enter the agent’s reasoning layer without touching a network appliance. When an agent is granted tool access across multiple systems, it can escalate privilege across pipeline steps in ways that only make sense with application-state awareness. When it processes queue messages derived from user input several hops back, the chain of trust that justified the original access is no longer verifiable at the call site.

A Dark Reading survey found 48% of cybersecurity professionals identify agentic AI as the top emerging attack vector heading into 2026. The exposure is not theoretical — it reflects that agent deployments moved faster than the security tooling built around pre-agent assumptions.

Stack Archive’s analysis of agentic perimeter defense approaches covers the broader architectural question of where AI system trust boundaries should sit; Guards represents a concrete implementation answer.

What Arcjet Guards Enforces

Guards runs security rules inside AI agent tool handlers, queue consumers, and workflow steps — any code that processes untrusted input without a Request object. Three enforcement categories define the current capability:

Prompt injection detection. Guards evaluates fetched content before it re-enters the model’s context window. The implementation wraps the tool call result in a guard evaluation:

const decision = await arcjet.guard({
  label: "tool.fetch",
  rules: [promptInjection(content)],
});

The guard receives untrusted input as a function argument, evaluates it against defined rules, and returns an allow or deny decision with full application context — including authenticated user identity, session state, and business logic that a network appliance cannot access.

Token budget enforcement. Per-user and per-session token limits are applied inside the agent loop, preventing runaway spending from malformed requests, adversarial inputs that generate verbose model responses, or misconfigured pipeline steps. The $8,000 overnight burn scenario is exactly what this addresses — budget exhaustion that accelerates without a triggering event visible at the HTTP layer.

PII blocking. Guards intercepts personally identifiable information — emails, card numbers, identifiers — before messages reach third-party LLM providers. This is particularly relevant for agents that process customer-facing input and route it through external model APIs under the application’s authentication context.

The integration model is code-as-configuration: security rules live in the same file as the protected handler, making them visible during code review and accessible to AI coding agents that generate diffs. Arcjet provides an MCP server and CLI for agents to inspect analytics and promote rules without leaving their editor environment.

Source: Arcjet Blog

Content created with AI assistance and reviewed for accuracy.