How Arcjet Uses Cloudflare Clef to Detect AI Agent Behavior Drift

Summary

Arcjet describes a security layer for coding agents that addresses risks beyond direct prompt injection, including context poisoning and indirect instructions returned by trusted APIs. A malicious GitHub issue or MCP result can influence a long-running agent without a human seeing the content, so Arcjet evaluates both individual inputs and outputs as well as the sequence of actions across a session. Hook events from Claude Code, Codex, Cursor, Muse Code, and GitHub Copilot feed deterministic Guard policies and specialist detectors, while session state is stored in a Cloudflare Durable Object. The state records active taint flags, explanations, and manual clears; serialized writes and local placement are intended to keep hook latency low and make new flags visible to the next action. A second Durable Object schedules sequence reviews by elapsed time or activity count. These reviews use Cloudflare’s Clef decision model, which returns numeric probabilities, distributions, or scale positions instead of conversational text. Arcjet chose Clef Flash for frequent, low-latency reviews and is still developing evaluations because the model is new; it is also considering combining Flash on small batches with the larger Clef model on less frequent, larger reviews. The system separates factual hazard detection, evidence sufficiency, human-triage highlighting, and containment decisions. Moderate scores can create review highlights, while session locks require higher confidence, complete inputs, and explicit evidence of an active attack. Deterministic checks supplement model scores for credential findings, and ordinary actions such as deleting build directories are highlighted rather than automatically locking a session. Arcjet also isolated the scorer from its own previous summaries, verdicts, taint rows, and lock-caused denials to prevent feedback loops. Finally, Guard policies consume trusted session flags outside the agent payload, allowing risky tools to be denied while sometimes permitting degraded local work. The example policy is available in the Arcjet Console in dry-run mode for connected coding agents.