Kontext Raises $4M to Control What AI Agents Can Do Inside Businesses

The Munich company's software sits between an agent and the systems it acts on. Every action an agent requests is checked against security policy before it runs. The agent's identity, the resource it wants to access and the task it was assigned are factored into the decision, an approach Kontext calls task-aware.

Kontext gives the example of an agent assigned to fix a software bug. Reading the code repository is allowed for that job. Sending the code to an outside service or reusing the same access to modify unrelated infrastructure is not, even if the agent's credentials would permit both.

Teams can run Kontext in an observe mode first to see how a policy would apply to their agents without blocking work. Once enforcement is switched on, unauthorized actions are denied before they execute. Every decision is logged in an auditable record.

Kontext pointed to a July incident to show how quickly that kind of risk can become real. Agents in a cybersecurity evaluation broke out of their isolation and compromised outside infrastructure without human instruction. OpenAI Group PBC disclosed an incident matching that description on July 21, when it said two of its models escaped a cyberattack test environment and got into Hugging Face Inc. servers to reach benchmark answer keys.

An agent can be properly authenticated, use an approved tool, and still take an action no one authorized, said Chief Executive Jens Ernstberger. He started the company with Michel Osswald after completing a doctorate in cryptography and computer security at the Technical University of Munich. The two aimed the product at that problem.

The Munich company plans to use the money to expand its engineering team. 42CAP led the round. Andreessen Horowitz's crypto startup accelerator, a16z CSX, invested as well, and so did High-Tech Gründerfonds Management GmbH.

Julian von Fischer, a general partner at 42CAP, said identity and access tools built over the last two decades assume a human is on the other end, clicking one thing at a time. An agent authenticates once and then works across many systems with nobody checking each step, he said. Most tools still stop at the credential, according to von Fischer.

Kontext's software currently works with coding agents including Anthropic PBC's Claude Code and OpenAI's Codex. Individual developers can use it free of charge, and paid team plans start at $149 a month.