French Startup Edamame Builds Runtime Watch for AI Coding Agents
The platform uses host telemetry and AI analysis to flag intent drift, secret theft, and supply-chain interference — in real time, before the damage lands.
AI coding agents write code, run commands, and pull dependencies with minimal human oversight. That autonomy is the point. It is also the problem.
Edamame, a France-based startup, is pitching a runtime verification platform designed to catch the moment an AI coding agent starts doing something it was never asked to do. The company calls this "intent drift" — a term for when an agent's actions diverge from its original task scope.
The platform watches at the host level, ingesting telemetry from the machine running the agent and feeding it through an AI analysis layer. Three threat categories sit at the center of its detection model: intent drift, secret theft, and supply-chain attacks.
Secret theft is the obvious one. Coding agents routinely have access to API keys, tokens, and credentials sitting in environment variables or config files. A compromised or misbehaving agent can exfiltrate those quietly. Supply-chain interference — where an agent fetches a malicious dependency or injects code into a build pipeline — is harder to catch after the fact and harder still to attribute.
Intent drift is the subtler category. It covers behavior that isn't obviously malicious but isn't sanctioned either: an agent browsing outside its expected network scope, spawning unexpected child processes, or touching files unrelated to its task.
Edamame hasn't published a detailed technical whitepaper at the time of writing, so the precise mechanics of its detection logic — what telemetry signals it collects, how it baselines normal agent behavior, what its false-positive rate looks like — remain unverified.
The product sits in a category that is forming fast. As organizations pipe AI agents into CI/CD pipelines and developer environments, runtime observability for non-human identities is becoming a genuine gap. Traditional endpoint detection tools were built for human operators. They weren't designed to distinguish "developer ran npm install" from "agent silently fetched a typosquatted package at 2 a.m."
Edamame's jurisdiction for regulatory purposes falls under France's CNIL and, where enterprise customers are involved, the broader EU AI Act and GDPR frameworks — both of which impose obligations on systems that make automated decisions or process personal data.
No breach disclosure or incident is attached to this announcement. This is a product launch.
