Imagine an AI coding agent asked to fix a production bug. It has authenticated correctly, received access to the repository and been given the tools it needs. Reading the relevant code is reasonable. Running tests is reasonable. But those same credentials may also let the agent inspect unrelated files, call an external service or perform an action nobody intended when the task began. Nothing necessarily failed at login. The failure appears later, when valid access becomes the wrong action.
That distinction became the foundation for Kontext, the Munich-based AI security startup founded by Jens Ernstberger and Michel Osswald. The company has now raised $4 million in funding led by 42CAP, with backing from a16z CSX and HTGF, giving it fresh capital to expand its engineering team and develop the runtime security layer it believes autonomous agents will increasingly require.
The founders started with a credential problem
Kontext’s origin is easier to understand through the problem the founders were already seeing around AI coding agents. These systems were becoming useful precisely because they could reach outside the model: into GitHub, APIs, databases and other services. But the simplest way to give them that access was often also the most dangerous.
In an account of the company’s early work, Ernstberger wrote that they built Kontext because coding agents needed access to services such as GitHub, Stripe and databases while many teams were still putting long-lived API keys into environment files or even directly into chat interfaces. The problem, he argued, went beyond secret sprawl. Once raw credentials were handed to an autonomous process, companies lost much of their ability to understand which developer launched which agent, what it accessed and whether the access was appropriate for the task.
Ernstberger and Osswald brought backgrounds in secure computing, applied cryptography and AI systems to that problem. Rather than building another agent, they began working on the infrastructure around agents: identity, narrowly scoped credentials and the ability to make a fresh security decision as the software moved through a task.
That work eventually led to a larger realization. Giving an agent the right credential does not mean every use of that credential should be trusted.
As Ernstberger puts it, “An AI agent can be properly authenticated, use an approved tool, and still take an action no one authorized.”
Kontext moves the decision closer to the action
Traditional identity systems remain important, but Kontext argues that they answer a broader question: whether a user or service generally has permission. An autonomous agent creates a narrower one: should this particular action be allowed now, for this user, in this session, against this resource?
Kontext calls its answer runtime authorization.
Its software sits at what the company describes as the tool-invocation boundary, the point where an agent’s reasoning becomes a real command, API call, credential request, file operation or MCP tool action. Before that action executes, Kontext can evaluate the user, agent session, tool, resource, parameters, policy and risk signals and return a decision to allow, ask for approval or deny.
The current product checks tool calls from environments including Claude Code, Codex and Cowork. Kontext says deterministic policies handle known hard boundaries, while a local risk evaluator can assess less obvious actions. Because those decisions happen locally, the company is trying to add control without turning every agent action into a slow trip through a remote security gateway.
This is an important part of the company’s philosophy: Kontext does not need to prove what is happening inside the model’s mind. It needs to decide whether the consequence of its next action is acceptable. Ernstberger has argued that attempting to “verify intent” can become ambiguous; a more enforceable target is whether the requested action is safe under the current identity, resource, credential and session context.
Observe first, enforce second
Security controls around developers have an obvious failure mode of their own: if they interrupt legitimate work too often, people find ways around them.
Kontext therefore begins deployments in observe mode. Agent activity continues while the system records what it would allow, question or deny. Security teams can use those traces to understand the real behavior of their agents and tune policy before enforcement begins. Once the rules match the organisation’s intent, teams can switch to enforcement so destructive or higher-risk actions are stopped or escalated before execution.
The approach reflects another lesson in Kontext’s research: risky outcomes can emerge from sequences of individually acceptable actions. An agent may legitimately read code and legitimately have network access, yet combining those capabilities in the wrong way can create a path for sensitive information to leave the environment. That is why the company treats sandboxing, credentials and runtime authorization as different layers rather than interchangeable security mechanisms.
Kontext applies the same thinking to credentials. Instead of giving an agent standing authority through a broad API key or OAuth token, its architecture is built around short-lived, task-scoped credentials that can be issued only after the current action has passed policy checks. The company’s documentation describes this as least privilege applied at runtime rather than merely at account setup.
The $4M bet is that agent security becomes infrastructure
Kontext’s timing reflects how quickly the object being secured is changing. AI systems are moving from generating text toward running commands, editing files, opening pull requests, calling APIs and touching production-adjacent systems. As that happens, a security model designed around a human logging in and clicking through predictable actions begins to encounter software that can select and chain actions autonomously.
The new funding gives Kontext more resources to move from developer-focused local controls toward broader team and enterprise governance. Its documentation already describes a path from local policy checks to shared traces, organisation-wide controls and review for security, platform and compliance teams, while the company is hiring around the SDK, APIs and authentication primitives that agents use to request scoped access.
The larger question is whether enterprises will eventually consider runtime authorization as fundamental to agents as identity management became to human users.
Ernstberger and Osswald started with the practical problem of agents carrying credentials they should not permanently possess. They arrived at a broader one: once autonomous software can act on a company’s behalf, authentication alone cannot explain whether its next move belongs inside the task it was actually given.
Kontext is building for the milliseconds between an agent deciding to do something and the real system doing it. If agents continue moving from assistants to operators, that small window may become one of enterprise security’s most important new control points.
About Kontext
Kontext is a Munich-based AI security company built by Cobrowser Technology GmbH. Founded by Jens Ernstberger and Michel Osswald, the company develops runtime authorization infrastructure for AI agents, with a focus on local-first policy enforcement, scoped credentials, least-privilege access and readable audit trails for autonomous tool use. Kontext is designed for developers as well as security, platform and compliance teams deploying agents that interact with APIs, MCP tools, files and production systems.
