Endpoint observability for AI agents running on employee machines

Origin Technology frames its product as the next layer of endpoint security, in a line that runs from antivirus watching files to EDR watching process and system logs. Its claim is that neither sees the substance of what an AI agent does: an agent reads a file, runs a command, and calls a tool, and to existing tooling that looks like a legitimate editor process doing ordinary things. Nothing upstream records that the work was agent-driven, which user prompted it, or whether the outcome matched the request. The team behind it comes from endpoint software, security research, operating system internals, and offensive engineering, and the company is backed by Sequoia Capital, Brightmind Ventures, and IA Ventures.

The sensor captures agent activity at the endpoint and attributes it through a chain linking user, agent, and process. That includes file reads and writes, command execution, tool calls, MCP server connections and their configurations, agent installations and authentications, prompt volume, and token consumption. From that stream Origin produces fleet discovery showing every agent and MCP server in the estate and whether it is sanctioned, session traces that reconstruct a full workflow from the original prompt through to the change it produced, activity clustering, and spend analysis. CISOs use it for approval workflows and audit, CIOs for tracking where AI investment is going and which teams are using it, and developers for visibility into agents on their own machines.