Arcjet Himalia

Arcjet Himalia 1 is Arcjet's general-purpose prompt-injection classifier, a full fine-tune of Qwen3-0.6B (Apache 2.0) with a two-way benign/injection head. Their blog is dated 5 November 2026: every SDK call that uses prompt-injection detection now runs on Himalia 1. The same family announces early-access Arcjet Thebe 1 (coding agents) and Arcjet Carme 1 (autonomous security agents), featured with Arcjet's custom AI security models around Product Hunt on 2026-11-09.

Motivation: frontier models are slow, pricey and inconsistent as inject detectors; many open classifiers fail on commercial licenses, overlapping/noisy data, or disagreed attack definitions. Himalia targets chatbot/model endpoints that should treat SQL, shell and “print your instructions” as out of bounds; coding and security agents need specialists because legitimate traffic looks like attacks. The API returns a verdict, not a score, so attackers get less threshold feedback and retrains do not silently shift customer-tuned cutoffs. Reported public-set figures include F1 ≈ 0.964 on neuralchemy/Prompt-injection-dataset and ≈ 0.971 on jackhhao/jailbreak-classification (see their table).

Highlights:

• Post: https://arcjet.com/blog/introducing-arcjets-custom-ai-security-models ;
• Live on existing SDK prompt-injection paths; free trial available;
• Thebe / Carme are early access — contact required;
• Models run on Arcjet-controlled infra with SOC2 / HIPAA-oriented compliance narrative in the post;
• More detectors (e.g. content moderation on ShieldGemma) are slated to follow.

Why it matters

Once agents call tools and ingest external content, indirect prompt injection is a production incident class. A small specialist classifier in the request path returns a decision in milliseconds — cheaper and more consistent than a frontier judge, and broader than platform gateways that never see every agent hop. Splitting Himalia / Thebe / Carme matches the real rule that the same SQL string is an attack in support chat and a normal job for a coding agent.

Limits

Published metrics are on chosen datasets after their cleaning pipeline; your traffic will differ. Verdict-only output means no customer-side score thresholds. Thebe/Carme are not generally available yet. A classifier does not replace authz, sandboxing or least privilege — it is a detection layer, not a full agent-security stack.

1. Read https://arcjet.com/blog/introducing-arcjets-custom-ai-security-models ;
2. Integrate the Arcjet SDK with prompt-injection detection (free trial); existing calls should already hit Himalia 1;
3. For coding or autonomous security agents, ask Arcjet for Thebe / Carme early access and share false-positive samples;
4. Pair detection with tool permissions and session audit — do not rely on the label alone.