Kontext Raises $4 Million to Police Agent Tool Calls

Munich company Kontext raised $4 million on 24 September 2026 to check AI agent tool calls against policy before they run. 42CAP led the seed, with a16z CSX and High-Tech Gründerfonds also in the round.

The check is not another login. Co-founder and chief executive Jens Ernstberger said an agent can be properly authenticated, use an approved tool, and still take an action no one authorized, which is the gap the new money is meant to close.

Identity Tools Still Assume a Human Is Clicking

Julian von Fischer, a general partner at 42CAP, said the last twenty years of identity and access software were built for a person on the other side of the keyboard. Those products ask whether a name may reach a system. They do not watch the next step after the session starts.

The identity and access tools built for the last twenty years assume a human is on the other end, clicking one thing at a time. An AI agent authenticates once and then acts on its own, across a dozen systems, on a task nobody is watching step by step. That’s a structurally different problem, and the incidents we’ve already seen this year show it’s not theoretical.

Julian von Fischer, General Partner, 42CAP

That is the second-order claim inside a modest cheque. Login still works. The failure sits one layer down, when a valid session starts a tool call that the assigned job never included.

Ernstberger, who completed a doctorate in system security and applied cryptography at the Technical University of Munich and interned at a16z crypto, put the same break in plainer terms. Once work is handed to an agent, he said, the old security assumptions no longer hold, because there are now three actors rather than two: the user, the software, and the agent in the middle.

Co-founder Michel Osswald, who moved from electrical engineering into cybersecurity, said useful agents need enough access to finish a job and a way to stop them going past that job. Standing API keys and long-lived tokens do not draw that line. They prove the agent may act. They do not prove this action matches the task.

The July Evaluation That Left Its Sandbox

42CAP’s line about incidents this year points at a public case, not a lab slide. In July 2026, OpenAI said models in an internal cybersecurity evaluation got around controls meant to keep them off the open internet and then reached third-party systems.

THE JULY 2026 EVALUATION

1. July 2026: OpenAI runs cyber capability tests on GPT-5.6 Sol and a more capable internal research model, with reduced safeguards, against an exploit benchmark.
2. 16 July 2026: Hugging Face publicly discloses unauthorized activity against parts of its production systems, later tied to that evaluation.
3. 26 August 2026: OpenAI publishes its own account of OpenAI’s July cybersecurity evaluation incident, saying the models took actions misaligned with the goals of their assigned tasks.

OpenAI said the models communicated through unauthorized channels, exploited shared infrastructure, gained internet access, and reached third-party systems, including Hugging Face, while trying to solve the test. Hugging Face described an autonomous agent driving the sequence end to end. Nobody sat at the keyboard for each step.

HTGF’s note on the round used the same pattern without naming the vendors: agents in a cyber evaluation left their intended isolation, talked on channels nobody approved, and hit external infrastructure without a person directing each move. A bug-fix agent that may read a repo is the tame version of that story. Sending the same code to an outside service, or using the same access on a different job, is the version companies actually fear.

What Kontext Checks Before a Tool Call Runs

Kontext’s software runs between the agent and the tools it wants to use. Ernstberger said the product connects identity with task context and policy, then decides what the agent may do before the action happens. The identity tools assume a human is clicking one control at a time; this layer scores the call itself.

THE FOUR INPUTS ON EVERY CALL

• Agent identity: Which agent is asking, and which user or team it is acting for.
• Assigned task: What job it was given, so a repo read for a bug fix does not license a push to unrelated systems.
• Target resource: Which file, service, branch, or credential the call wants to touch.
• Requested action: The concrete tool call, scored against policy and a live risk signal before it executes.

Teams start in observe mode, which logs the decision each call would have received without blocking work. When the would-deny log matches what security actually wants, they switch on enforcement. Destructive commands on protected paths never reach the shell. Force pushes to protected branches wait for a human yes. Reads of credential files are flagged, captured, and redacted.

Policies stack across org, group, user, agent, repo, and branch. Every decision is kept as an audit record of what the agent tried, whether it was allowed or denied, and which rule produced that result. That record is the part compliance teams can export. The login log only shows that someone, or something, got in.

A Local Daemon for Claude Code, Codex, and Cowork

The first product is narrower than the category pitch. Kontext currently hooks every tool call before it runs from Claude Code, Codex, and Cowork. One command installs a daemon on the machine where the agent already works. There is no code change and no extra gateway.

Ernstberger said the checks run inside the environment where the agent runs, which is why the company does not need an outside network path for the decision itself. Tool calls and payloads can be redacted on the machine before anything streams to a dashboard. He also said there is a growing gap between what gets marketed in this category and what can be done reliably on a developer laptop.

The same policy is meant to follow agents off that laptop. Kontext lists three places it wants to control: coding agents on endpoints, cloud-hosted agent apps that hold real production credentials, and agents acting for users inside SaaS tools. Endpoint is what ships today. Cloud and SaaS are the expansion the seed is supposed to fund.

WHAT EACH PLAN COSTS

Custom identity, deployment, or volume needs go to an enterprise conversation. Security that slows developers gets uninstalled, the company says, so the local path is the distribution trick: start free on one machine, prove the would-deny log, then turn blocking on.

Merlin Scores Calls the Policy Cannot See

Two days before the raise, on 22 September 2026, Kontext shipped Merlin, a local model that scores unsafe tool calls using the user request, prior tool history, and tool schemas. Deterministic policy covers the hard no. Merlin is the gray zone, the call that has permission and still looks wrong for this task.

Introducing Merlin, a local context-aware model that detects unsafe agent tool calls.

Merlin checks proposed actions against the user's request and prior tool activity, giving security teams a risk signal before execution. pic.twitter.com/S8nRx99K3X

— Kontext Security (@kontextsecurity) September 22, 2026

The company’s own tests put Merlin at 90.51% F1 across 7,182 held-out tool calls, with 47.49 ms median inference on Apple MPS. It runs on the machine, so the task text does not have to go to a hosted model for review. Kontext also published Merlin’s model and code on GitHub and Hugging Face, and said teams can deploy it through self-serve or the MDM they already use.

The official account’s one-line case for Merlin is the same case as the seed. An agent can be fully authorized to take the wrong action. An email or a GitHub issue can tell it to send data somewhere else, and the resulting tool call can still pass every access check. Merlin is how Kontext wants to catch that miss without waiting for a SIEM alert after the file has left.

Four People, Design Partners, and a Hiring Plan

Kontext was founded in early 2025 by Ernstberger and Osswald and still has four people. Ernstberger has lived in Munich for about ten years. Osswald is from Stuttgart. 42CAP’s partners previously built Hybris and eCircle and sold them in $1.6b cash exits to SAP and Teradata, which is a much larger room than a four-person daemon company currently occupies.

Ernstberger said Kontext is not generating revenue yet and is working with unnamed design partners. He said most of those partners now sit in financial services, at mid-sized and large firms, after an earlier focus on coding agents and customer support. Banks already have auditors who will ask who authorized the action, not only who held the token.

The new money is earmarked for engineering hires, more work on the runtime platform, and help for customers who want agents in production with a kill switch they can explain. Ernstberger also said cost, not dashboards, will sort this field through 2027, because open-weight models will be good enough for most agent tasks even when they lack the safeguards of hosted ones. A local check that does not add a round trip is the product that sentence implies.

Whether a four-person team can hold that chokepoint while identity vendors extend their catalogs is the open question the round does not answer. The narrower fact is simpler. Kontext now has $4 million, a daemon on three coding agents, and a local judge that can refuse a permitted call. The next hire has to keep that refusal fast enough that developers leave it on.