Edamame Launches Runtime Security Platform for AI Coding Agents

Summary

Edamame announced a host-side runtime platform that correlates AI coding-agent intent with host telemetry to detect drift and attack patterns. The vendor says it can detect supply-chain RAT activity, but cannot block installation or execution.

Key points

Edamame describes its platform as a host-side runtime evidence layer for checking coding-agent behavior against developer intent and detecting attack patterns.
Its divergence engine correlates captured agent intent with process, filesystem, network, tool-call and posture telemetry.
The detection engine runs CVE-aligned checks for credential harvesting, token exfiltration, sandbox exploitation, sensitive-file access and supply-chain behavior.
The platform lists integrations for Cursor, Claude Desktop, Claude Code, Codex and OpenClaw; Edamame Hub is intended to help teams review fleet-wide agent installations and findings.
In an Axios npm RAT scenario, Edamame says its system would detect activity after delivery, including beaconing and attempts to access or exfiltrate secrets, but would not block installation or operation.

Article Details

Event Type: Launch of a runtime security platform for AI coding agents
Impact: Edamame describes a host-side system that monitors coding-agent intent and runtime activity to detect divergence and attack patterns, including credential theft and supply-chain malware. The article says it would detect the Axios npm RAT after delivery, including its C2 beaconing and attempts to access and exfiltrate tokens and SSH keys, but would not prevent installation or execution.