EDAMAME Technologies

New agent every month. New MCP, new tools every week. Still in control. Cursor, Claude Code, Codex, Hermes, OpenClaw, and next month's. The MCP servers and tools they reach change faster than any policy. Most of the useful agent work in 2026 happens in use cases nobody pre-approved. Forbid it and productivity leaves; trust it and you learn later what the agent did. About the picture: a new rose every week, and we let them flourish. That is the whole idea, and our founder's smile is because we are happy to announce it: the new AI Governance page in EDAMAME Hub, the third route. Discover: every agent on every machine, observed from outside the agent, nothing installed into it. Which MCP servers it reaches, how they authenticate, whether a harness confines it, what its blast radius is. Audit: every AI check carries its OWASP GenAI, MITRE ATLAS, Agentic Trust Controls and ISO/IEC 42001 / ISO 27001 references. Filter the compliance table by the framework your auditor asks about. Govern: exceptions per cause, never per check. Accept one condition on one agent; every other cause keeps failing. Allowlists for agents and MCP servers, scoped, with an expiry. Raw statuses are never rewritten. And when the guardrail you already run stops holding, sandbox weakened, deny rule removed, denied command re-spelled, that is a finding. The full post, with the map of how this compares with endpoint platforms, AI gateways, in-agent guardrails, identity platforms and cloud-managed runtimes: https://lnkd.in/epgPFhhe #AIsecurity #AIagents #AIgovernance #ISO42001 Minh-Anh D., Quentin Vedrenne, Raj Mallempati, Amol Kabe, Frederic Griffoul, Kenny To, Ehsan Ahmadi, John Martin, Antoine Clerget, Dan Newman, Mark Day, Thierry Messmer, Didier LESAGE, Joan CHINAPPEN

A compromised AI agent will tell you everything is fine — and its own logs will back up the lie. So you cannot take the agent's word for it. The only reliable answer is the gap between what it declared and what it actually did on the machine: intent divergence (goal drift). It is now formalised, measured, and public. Our joint paper with the LISTIC lab (CNRS), "Runtime Security for Agentic Systems," is open-access on HAL — and we presented it at the PEPR IA Days 2026, France's national AI research programme (France 2030) managed by Inria, CEA and CNRS, in the Trustworthy AI pillar. The idea: check an agent's declared task against the ground truth of what it actually did — process lineage, files, sockets, posture drift observed from outside the agent, at the OS boundary, in a record it cannot fake or silence. On a live, reproducible benchmark, that gave zero false positives across the benign scenarios. Think of the agent as the cortex that reasons and declares intent, and the machine beneath it as the reptilian brain that actually acts — EDAMAME Technologies is the control layer between the two. This is the research backbone under the AI agent trust layer we build at EDAMAME: prove security posture and runtime behaviour, then bind access to that proof. Read the breakdown: https://lnkd.in/ejQHH-zz Paper (open access): https://lnkd.in/em4F5hqq Code + benchmark: https://lnkd.in/eQC-B_4y Minh-Anh D., Quentin Vedrenne, Raj Mallempati, Amol Kabe, Frederic Griffoul, Kenny To, Ehsan Ahmadi, John Martin, Freddy Mallet, Antoine Clerget, Dan Newman, Mark Day, Thierry Messmer

A stolen API key or OAuth token is a bearer credential: whoever holds it gets in, from any machine, anywhere. EDAMAME Technologies makes the stolen credential useless — access is granted only to a machine we can vouch for at that instant, not to whoever is holding the secret. Why that matters now: In 2026 the malware shipped correctly signed. The Shai-Hulud worm waves that hit npm and PyPI carried valid Sigstore signatures, valid SLSA Build Level 3 provenance, and a green "trusted publishing" badge — and were credential stealers. The attackers forged nothing; they scraped a live OIDC token out of a CI runner's memory and signed under the project's own identity. Every primitive the ecosystem spent a decade building verified the package end-to-end, and it rode 170+ packages and 200 million downloads a week onto developer machines. A signature, an attestation, a provenance record all verify the key — never the machine that held it at the moment it signed. A stolen signing identity produces perfect signatures. And the attacker is no longer always a person. The malware is vibe-coded — generated fresh per victim, invisible to signature scanners. Mini Shai-Hulud's full worm toolchain was open-sourced. Anthropic has documented an AI running 80–90% of an intrusion on its own. One stolen token now moves at machine speed across shell, repository, cloud and CI. Strip away the tradecraft and every 2026 breach ends the same way: a valid credential, used from a machine that should never have had it. So stop trusting the key. Trust the machine holding it. EDAMAME Security and EDAMAME Posture watch host truth — process lineage, credential-store reads, sensitive-file access, outbound traffic, posture drift. EDAMAME Hub turns that into an access decision through the controls you already run: IdP Conditional Access, GitHub Enterprise IP allow-lists, ZTNA. host behaviour changes → endpoint trust changes → the platform rejects the next request, even with a perfectly valid, perfectly signed token. The theft still succeeds. The use does not. Full analysis → https://lnkd.in/efWR9R5d #SupplyChainSecurity #RuntimeSecurity #DevSecOps Efi Gatmor, Keith Stewart, Steve Smoot, Charles Kaplan, Didier Perrot, Khaled H., Minh-Anh D., Thierry Messmer

“We are SOC 2 compliant.” So were GitHub and many other serious engineering organisations before they were hacked. That is the uncomfortable point. SOC 2 is not a force field. It is an attestation that your controls exist and operate over a defined scope. But the real scope has moved. It is no longer only the corporate laptop enrolled in MDM/UEM. It is BYOD. It is BYOPC. It is contractors. It is developer workstations with admin rights. It is CI/CD runners. It is coding agents with shell access and MCP-connected tools. The old recipe — enrol the fleet in MDM, collect the screenshots, pass the audit — was built for a simpler machine boundary. That boundary is gone. The question for 2026 is sharper: Can you continuously prove that every machine touching code, secrets, customer data or production systems is trustworthy at the moment it acts? That is what we wrote about here: https://lnkd.in/eG8pCEBF Minh-Anh D., Quentin Vedrenne, Raj Mallempati, Amol Kabe, Frederic Griffoul, Kenny To, Ehsan Ahmadi, John Martin, Freddy Mallet, Antoine Clerget, Dan Newman, Mark Day

Coding agents are becoming the execution layer for software delivery. They now operate in IDEs, shells, MCP tool calls, CI/CD runners and self-hosted agent runtimes. The security stack we built for laptops, identities and compliance frameworks was not designed for that. Today, EDAMAME Technologies is launching runtime verification and deterministic guardrails for coding and self-improving AI agents: a host-side evidence layer that detects intent divergence and attack patterns across developer workstations, CI/CD runners and cloud environments — with immediate alerts for credential harvest, token exfiltration and sensitive-file access. Same trust model from workstation to runner to cloud. Enforced outside the model, with evidence at the boundary. Reporting-only and developer-first, so adoption is not the price. 90s product demo on a real Cursor session (applies to Claude Code, Codex and OpenClaw): https://lnkd.in/eqMYT2Tm Read the full announcement: https://lnkd.in/euA-z7tp More on https://lnkd.in/e9cy6-EN Minh-Anh D., Quentin Vedrenne, Raj Mallempati, Amol Kabe, Frederic Griffoul, Kenny To, Ehsan Ahmadi, John Martin, Freddy Mallet, Antoine Clerget, Dan Newman, Mark Day

Only endpoints with observed, harnessed coding agents should be allowed to access code and secrets. That is the point of EDAMAME Technologies’s new Agentic Posture Visibility feature: start with local knowledge for the user, then roll the same observations up fleet-wide in EDAMAME Hub so policy becomes enforceable. The feature shows which agents exist, which are observed, which MCP servers and tools they can reach, what their blast radius is, and whether they are fitted with a governance harness (Rippletide and AgentField.ai initially supported). Visibility first. Then Zero Trust policy. Then Agentic Security when a divergence or attack pattern requires isolation. Minh-Anh D., Quentin Vedrenne, Raj Mallempati, Amol Kabe, Frederic Griffoul, Kenny To, Ehsan Ahmadi, John Martin, Freddy Mallet, Antoine Clerget, Dan Newman, Mark Day, Thierry Messmer Read the post: https://lnkd.in/eNmPZQM5