Arcjet launches Himalia 1 prompt-injection model; coding and security-agent variants in early access
Security company Arcjet launched Himalia 1, a prompt injection detection model it trained itself, on November 5; every SDK call using its prompt injection detection now runs on it. Prompt injection is text hidden in web pages, emails or tool results that poses as instructions to an agent. Himalia 1 is built on Qwen3-0.6B with all parameters fine-tuned, its text output replaced by a classifier that only answers normal or injection. Arcjet says such classifiers answer in milliseconds on one GPU. It returns a verdict, not a score, because a score helps attackers tweak a payload until it slips under the cutoff. Specialist versions are in early access: Thebe 1 for coding agents and Carme 1 for security agents, whose normal work with SQL, shell commands and attack write-ups trips general models.
Why it matters
Agents increasingly read outside content and act on it, which makes prompt injection a major risk. Tuning detection to each use case can cut false alarms for coding and security agents.
Sources1
Written by dalao.ai: the title, summary and why it matters are our own words. The original reports are the record; their publishers keep authorship.