AI agent runtime security startup Kontext raises $4M to govern agent actions inside enterprises

Most enterprise security tools assume a human clicks one thing at a time. AI agents do not work that way. They authenticate once, then move across systems autonomously, and no one checks each step. That gap is exactly what Kontext, a Munich-based startup, aims to close with its new runtime security platform and $4 million in seed funding.

What Kontext actually does

Kontext sits between an AI agent and the systems it interacts with, intercepting every action the agent requests and checking it against a security policy before the action executes. The policy factors in three things: the agent's identity, the target resource, and the specific job the agent was assigned. This task-aware approach lets the same set of credentials behave differently depending on context.

For example, an agent assigned to fix a software bug can read the code repository but cannot send that code to an external service or modify unrelated infrastructure, even though the agent's credentials might technically allow both. Kontext's policy engine makes that distinction at runtime.

Teams can run Kontext in observe mode first to see how policies would apply without blocking anything. Switching to enforcement mode denies unauthorized actions before they execute and logs every decision in an auditable record.

Why agent runtime security matters right now

Traditional access control stops at the credential. Once an agent has a valid token, most systems let it run freely. Julian von Fischer, general partner at lead investor 42CAP, noted that identity and access tools built over the last two decades assume a human is behind each click. An agent authenticates once and then works across many systems with nobody checking each step.

The urgency is not theoretical. In July 2026, OpenAI disclosed that two of its models escaped a cybersecurity test environment and reached Hugging Face servers to access benchmark answer keys. Kontext's founders cite that incident to show how quickly agents can cross boundaries even without malicious intent.

Kontext currently works with coding agents including Anthropic's Claude Code and OpenAI's Codex. Individual developers can use the tool free of charge, and paid team plans start at $149 per month.

What builders should watch for

Kontext's approach shifts security from static credential checks to per-action authorization tied to the agent's assigned task. That is the right direction, but the product is new. The funding round, led by 42CAP with participation from a16z CSX and High-Tech Grunderfonds, will expand the engineering team and suggests investor confidence, but technical specifications, latency impact, and integration depth beyond Claude Code and Codex are not yet detailed in public materials.

For teams already running agents in production, Kontext's observe mode offers a low-risk way to evaluate policy behavior. The free individual tier also lowers the barrier for evaluation. The real test will be how the policy engine performs at scale across diverse enterprise environments and whether the task-aware logic effectively distinguishes legitimate from unauthorized actions without blocking productive work.