Arcjet

Shipped from a JS/TS security library into an expanded AI-app security surface, including prompt-injection detection and tool-call authorization, within about two years of founding, a fast pace for a young infrastructure security startup.

The code-embedded approach genuinely simplifies adoption for developer teams versus configuring separate WAF or bot-management appliances, though coverage is currently limited to the JavaScript/TypeScript ecosystem rather than being language-agnostic.

Roughly $12 million raised from credible security-focused investors, including a16z's Zane Lackey, Plural, and Seedcamp, is a solid but still early-stage signal; no independently reported revenue or large-scale customer figures were found.

Packaging bot detection, rate limiting, and now AI-specific defenses as an importable code library rather than a managed appliance is a genuinely different distribution model from incumbent bot-management and WAF vendors, even if underlying detection techniques are not unique.

No independent, third-party test of Arcjet's bot-detection or prompt-injection-defense accuracy was found; effectiveness evidence to date is vendor-documented and case-study-based rather than independently benchmarked.

Bot traffic, API abuse, and now prompt-injection and agent-abuse are top-of-mind risks for any team shipping AI-backed applications, and Arcjet's code-first packaging matches how modern JavaScript and TypeScript teams already build and ship.