AI agent behavior drift analysis with Cloudflare Clef

Arcjet built a real-time monitoring layer for AI coding agents to catch indirect prompt injection and behavior drift that per-call policies miss. Rather than relying only on deterministic checks at each tool call, the system records session activity in Cloudflare Durable Objects to serialize writes, provide immediate flags, and keep reads low-latency. Activity is accumulated and analyzed in batches by a decision model so multi-step attacks (for example, reading tokens then uploading data) are detected across a sequence of seemingly benign actions. The implementation runs on Cloudflare Workers close to users for performance and scalability.

Sequence review uses Cloudflare’s Clef decision model (Clef Flash for frequent, cheap scoring) with structured, typed questions that separate facts, sufficiency of evidence, triage needs, and containment decisions. Different thresholds drive highlights versus locks: highlights alert humans at moderate scores while locks require high confidence plus full input evidence and explicit containment answers. The scorer deliberately ignores Arcjet’s own summaries and verdicts to avoid feedback loops, and credential findings demand concrete evidence such as exfiltration steps. Session flags are enforced by Guard policies that read durable-object state, balancing developer experience against security through conservative locking and deterministic rule fallbacks.