San Francisco – November 06, 2026 -- Arcjet released Himalia 1, a prompt injection detection model that scored F1 values of 0.964 and 0.971 on two public datasets, and opened early access to two further models built for coding agents and autonomous security agents.
Three models target different agent environments
Himalia 1 is generally available and is a general-purpose detector for chatbots, AI applications and model endpoints. It flags attempts to override application instructions, extract internal information or manipulate agent behavior.
Thebe 1, for coding agents, is designed to separate legitimate development activity from malicious instructions hidden in tool outputs, web pages and repositories. Arcjet says it is built to cut false positives when agents run commands or touch code.
Carme 1, for autonomous security agents, targets instructions that try to redirect an agent into leaking secrets, weakening security controls or introducing malicious dependencies. These agents routinely read vulnerability reports and malicious code that conventional detectors may wrongly flag.
Context-specific detection targets false alarms
Arcjet says a shell command that looks suspicious in a customer support chatbot can be appropriate for a coding agent. CEO David Mytton said one detection model applied everywhere creates false alarms and misses real threats, and that the models are meant to be fast and cheap enough "to run on every request."
The company pairs behavior classification with session-level analysis. Suspicious content is evaluated against the agent's assigned task, tool activity and session history, which targets attacks spread across multiple interactions.
Himalia 1 posts precision above 96.9% on public benchmarks
Across different evaluation datasets, Himalia 1 recorded precision of 96.9% and 97.8% and recall of 95.8% and 96.4%. The initial models are fine-tuned from Qwen3-0.6B, an open-weight model with 600 million parameters. They use a classification architecture that returns a security verdict without generating text, so detection runs in milliseconds, before an agent executes a harmful action.
Arcjet built its own models after finding limitations in open-source prompt injection detectors, including inconsistent training data, licensing restrictions and high false-positive and false-negative rates. Training combined manually reviewed public datasets with proprietary data.
The company also tests against encoded and obfuscated attacks, including base64, hexadecimal encoding, reversed text and manipulated chat formatting. Deterministic decoders identify known patterns so the models can assess decoded content alongside the original input. Arcjet runs the models on infrastructure it controls and maintains a rapid retraining pipeline for new attack patterns.
NetBird deploys detection in its network-configuration assistant
NetBird, whose AI assistant helps configure network environments, uses Arcjet's prompt injection detection. CEO and co-founder Misha Bragin said the new models raise his confidence in the security of NetBird's production environments.
The models extend Arcjet's runtime security features, which let organizations observe agent activity, detect shadow AI, enforce policies and keep audit records. Detection integrates in-code into coding agents and custom agents, covering activity that may bypass a centralized AI gateway.
Himalia 1 reaches all customers immediately
Himalia 1 is available now to all customers using Arcjet's prompt injection detection through its SDKs and coding agent integrations. Thebe 1 and Carme 1 are in early access for organizations developing coding agents and autonomous security agents.