# Origin Technology

> Origin Technology is building the endpoint AI observability platform for AI-adopting organizations. Origin runs on the endpoint and gives complete visibility into what every AI agent and MCP server is doing: every prompt, tool call, file touched, and network call, attributed end to end to the user, agent, and process.

## Product
- [Approach](https://www.originhq.com/approach): How Origin captures AI activity on the endpoint at the TLS layer with process attribution.
- [Pricing](https://www.originhq.com/pricing): Plans from a single user to an entire organization.
- [Careers](https://www.originhq.com/careers): Origin's mission, team, principles, and how we hire.
- [Jobs](https://www.originhq.com/open-roles): Open roles building observability for autonomous software.

## Research
- [A Poisoned AI Agent Wrote My C2 Redirector](https://www.originhq.com/research/redirector-from-a-compromised-endpoint): A planted AGENTS.md turned a finance analyst's own Codex CLI into a C2 redirector builder. Claude Code refused the same instruction until it was reworded.
- [PolicyHelpers Are a Little Too Helpful](https://www.originhq.com/research/policyhelper): Introducing PolicyHelpers Configuring Claude Code agents running in your environment is a deceptively complex topic. The configuration data itself, referred…
- [A PDF Picked My Model](https://www.originhq.com/research/a-pdf-picked-my-model): A PDF an agent reads can silently downgrade your model from Fable to Opus in Claude Code, a documented reroute that doubles as a model-downgrade lever an adversary can force.
- [How Much ‘Alpha’ Lives in Your AI Traces?](https://www.originhq.com/research/how-much-alpha-lives-in-your-ai-traces): Five ordinary AI sessions were enough to recover private operating rules, and richer traces gave up more. Whoever holds the traces holds a piece of the company.
- [The Mole in the Model - You've Hired an Adversary](https://www.originhq.com/research/the-mole-in-the-model): A backdoor in an open-weight model survives fine-tuning and fires on a hidden trigger, so where you run it does not matter. Defense lives on the endpoint.
- [A Morning Reversing Antigravity](https://www.originhq.com/research/a-morning-reversing-antigravity): Google Antigravity's agy.exe carries five undocumented flags. A hidden --release_base_url redirects the signed self-updater with no signature check.
- [The Repo Ran First - The Hidden Execution Paths in AI Coding Agents](https://www.originhq.com/research/the-repo-ran-first): Cloning a repo and opening Claude Code, Opencode, or Gemini CLI can run attacker code before the model runs, via custom slash commands and SessionStart hooks.
- [MXC Internals: How Microsoft's eXecution Containers Actually Isolate Agent Code](https://www.originhq.com/research/mxc-execution-containers-internals): Microsoft's open-source MXC isolates untrusted agent code with ten backends, from AppContainer capability SIDs and Job Objects to Hyper-V micro-VMs.
- [When Background AI Agents Become a Security Boundary Problem](https://www.originhq.com/research/background-c2-agent): Claude Code's undocumented daemon supervisor keeps background sessions alive past the terminal, enabling a persistent C2-like agent from Markdown and JSON.
- [The Mythos We Have At Home: A Patch-Diffing Pipeline for N-Day Generation](https://www.originhq.com/research/patch-diffing-pipeline): PatchWatch and Pocsmith form a two-stage patch-diffing pipeline that turns Patch Tuesday updates into LLM-ready binary diffs and verified N-day POCs.
- [All Your Claude Are Belong To Us - Redux](https://www.originhq.com/research/reversing-remote-control-redux): Claude Code's --sdk-url allowlist is bypassed via /etc/hosts redirection or an HTTP CONNECT proxy plus NODE_TLS_REJECT_UNAUTHORIZED=0 to reach a rogue C2.
- [Your Agent's Hidden Supply Chain](https://www.originhq.com/research/protecting-agentic-supply-chains): Man-in-the-Environment attacks abuse a computer-use agent's local config files as a hidden supply chain, requiring session-level behavioral baselines to detect.
- [Codex on the Wire: One Flag Away From a Network Service](https://www.originhq.com/research/codex-on-the-wire): OpenAI's codex CLI app-server bound to 0.0.0.0 becomes an unauthenticated network service: a remote client sends initialize and drives the agent over WebSocket.
- [Talking to the Agent Next Door: Adversarial Advantages of On-Device Agent Protocols](https://www.originhq.com/research/acp-adversarial-advantages): Zed's Agent Client Protocol lets an attacker drive a coding agent already running on a compromised endpoint, auto-approving every permission over JSON-RPC.
- [Post Start Command-Line Substitution](https://www.originhq.com/research/post-start-command-line-substitution): A second command-line tampering window exists between process start and application start in ntdll!LdrInitializeThunk, evading EDR that logs at creation.
- [All Your Claude Are Belong To Us: Reversing Claude Code's Remote Control Protocol](https://www.originhq.com/research/reversing-remote-control): Claude Code's undocumented --sdk-url flag points Remote Control worker processes at any server, turning the coding agent into a beaconing C2 channel.
- [How we hijacked a browser through Claude's Chrome extension](https://www.originhq.com/research/claude-for-chrome-takeover): Claude's Chrome extension exposes an unauthenticated named pipe any local process can drive to inject arbitrary JavaScript and steal cookies, no exploit needed.
- [Privilege Escalation via Confused Deputies in Coding Agents](https://www.originhq.com/research/escaping-the-sandbox-confused-deputies): Confused-deputy tradecraft lets a prompt-injected coding agent reach a more privileged context, escalating privilege across Claude Code and Codex on Linux.
- [ODR: Internals of Microsoft's New Native MCP Registration](https://www.originhq.com/research/msft-odr-mcp): Reverse engineering Odr.exe reveals how Windows On-Device Registry runs MCP, via undocumented COM interfaces, a SQL-backed consent database, and ETW audit.
- [Semantically Packaged Tradecraft: Credential Dumping](https://www.originhq.com/research/praxis-credential-dumping): Threshold management coaxes a local Claude Code agent into OAuth token extraction from Gmail and Outlook, run as a Praxis semantic credential-dumping operation.
- [Brainworm - Hiding in Your Context Window](https://www.originhq.com/research/brainworm): Brainworm is promptware that infects Claude Code, Codex, and Gemini CLI via CLAUDE.md memory files, taking natural-language C2 tasking from Praxis with no code.
- [Introducing Marco, a Tool for Inter-Binary Control Flow Mapping](https://www.originhq.com/research/introducing-marco): Marco is a control flow mapping tool that models execution across multiple binaries, treating functions as graph nodes to trace flow through the whole OS.
- [Process Preluding: Child Process Injection Before The Story Begins](https://www.originhq.com/research/process-preluding): Process Preluding injects code into a child process using legacy NtCreateProcess APIs before any process-creation callback fires, leaving no ETW WriteVm events.
- [Introducing Praxis: An Adversarial Framework for Exploring Computer Use Agents on Endpoint](https://www.originhq.com/research/praxis-announcement): Praxis is an open-source adversarial framework to discover, control, and orchestrate computer-use AI agents like Claude Code across remote endpoints.
- [Semantic Protocol Confusion: When My LLM Thinks It's a Web Browser](https://www.originhq.com/research/semantic-protocol-confusion): LLMs with browsing tools read a fake HTTP 307 redirect in page HTML as a real instruction and act on it. ChatGPT, Claude, and Comet acted, Copilot did not.
- [Check Your Privilege: The Curious Case of ETW's SecurityTrace Flag](https://www.originhq.com/research/securitytrace-etw-ppl): Windows ETW's undocumented SecurityTrace flag can be stopped with admin rights alone, enabling EtwTI consumption without Antimalware-PPL or a kernel driver.
- [cua-kit: Attacking the Intelligent Endpoint](https://www.originhq.com/research/cua-kit-attacking-the-intelligent-endpoint): cua-kit weaponizes AI agents already on a compromised endpoint, with BOF tools to enumerate Claude Code, Codex, and Cursor configs, run prompts, and persist.
- [Rehabilitating Registry Tradecraft with RegRestoreKey](https://www.originhq.com/research/rehabilitating-registry-tradecraft-with-regrestorekey): RegRestoreKey writes registry keys from a hive file, creating Windows services for persistence while evading EDR ETW and CmRegisterCallback registry telemetry.
- [Escaping Loader Locks with PostProcessInitRoutine](https://www.originhq.com/research/escaping-loader-locks-with-postprocessinitroutine): PostProcessInitRoutine in the Windows PEB runs payload code outside the loader lock, letting DLL sideloading execute without the DllMain deadlock risk.
- [Windows ARM64 Internals: Deconstructing Pointer Authentication](https://www.originhq.com/research/windows-arm64-internals-deconstructing-pointer-authentication): Windows on ARM64 implements Pointer Authentication (PAC) using only key B for instruction pointers, with keys in APIBKey registers and HVCI guarding enablement.
- [Unexpectedly Out-Of-Context: Detecting a LockBit Sample](https://www.originhq.com/research/unexpectedly-out-of-context-detecting-a-lockbit-sample): LockBit 3.0 was caught before encryption via hardware telemetry, LBR and EtwTI, flagging its private-memory trampoline API resolution, no malware signatures.
- [Introducing Runtime Memory Protection](https://www.originhq.com/research/introducing-runtime-memory-protection): Origin Runtime Memory Protection is a user-mode Rust agent that detects out-of-context execution, catching in-memory injection and fileless malware.

## Blog
- [The Last Mile Problem of Enterprise AI](https://www.originhq.com/blog/the-last-mile-problem-of-enterprise-ai): Skills package institutional knowledge into repeatable AI workflows, but distributing them is a faith-based initiative without visibility into who runs them.
- [What is an AI Trace?](https://www.originhq.com/blog/what-is-an-ai-trace): An AI trace records the path from prompt to outcome, including tool calls, files, commands, and actions. Learn why traces matter for AI agents.
- [Prelude is now Origin: the endpoint AI observability company](https://www.originhq.com/blog/prelude-is-now-origin): Prelude Security is now Origin Technology, focused exclusively on endpoint AI observability. Why the endpoint matters again, and what we are building next.
- [Observability is the next generation of endpoint security. SACR just mapped the market.](https://www.originhq.com/blog/sacr-maps-endpoint-observability): Observability is the next generation of endpoint security. A new SACR report maps the endpoint control and prevention market, and Origin sits in Zone 3, agent runtime observability.
- [I Killed Our Standup: How I Use Origin as an Engineering Leader](https://www.originhq.com/blog/i-killed-our-standup): How Origin's engineering lead runs the team on Origin: live project queries, a morning report instead of a standup, and drift alerts instead of check-ins.
- [Observability Requires Proximity](https://www.originhq.com/blog/observability-requies-proximity): Observability requires proximity. You cannot capture a system's internal state from a distance, so AI observability must live on the endpoint where agents run.
- [AI Adoption and the Distribution of Intelligence Problem](https://www.originhq.com/blog/distribution-of-intelligence): Vendor dashboards show AI token spend by user but not whether the work warrants it. The prompts and agent trajectories that answer that live on the endpoint.
- [Your CISO is Becoming a Safety Architect (Whether They Know It or Not)](https://www.originhq.com/blog/your-ciso-is-becoming-a-safety-architect): The CISO role is shifting from security to safety as productive, not malicious, AI agents become the top enterprise risk and demand intent-level observability.
- [Exploring the Broken Audit Trail for Artificial Intelligence](https://www.originhq.com/blog/exploring-the-broken-ai-audit-trail): AI agents deliver work with no record of the steps between prompt and output, leaving organizations a governance and safety gap as they scale AI adoption.
- [AI Visibility Belongs on the Endpoint](https://www.originhq.com/blog/ai-visibility-belongs-on-the-endpoint): AI runs as processes on the endpoint, so endpoint telemetry is the only layer that correlates the prompt, response, files, and child processes in one chain.
- [What is Endpoint Observability?](https://www.originhq.com/blog/what-is-endpoint-observability): Endpoint observability reconstructs an endpoint's internal state and intent from telemetry, not just events, to see how people and AI agents actually work.
- [Lacking Intelligence About Our Intelligence](https://www.originhq.com/blog/lacking-intelligence-about-our-intelligence): MDM and EDR tools cannot answer who on a team uses AI or how. Origin closes that endpoint visibility gap across the three phases of enterprise AI adoption.
- [What is AI Observability?](https://www.originhq.com/blog/what-is-ai-observability): AI observability captures the full trajectory of AI agents, prompt to outcome, so organizations can govern, audit, and measure their digital workforce.
- [The Era of Semantic Security: Computer Use Agents and the End of Signatures](https://www.originhq.com/blog/era-of-semantic-security): Local computer use agents break signature-based detection: legitimate and malicious use look identical, so defense must reason about intent and context.
- [It's (Finally) Time For The Next Generation of Endpoint Security](https://www.originhq.com/blog/time-for-the-next-generation-of-endpoint-security): AI agents generate novel, autonomous, legitimate-looking code that breaks AV and EDR detection, opening the next generation of endpoint security.

## News
- [Origin Names Birgit Troy Chief Operating Officer to Drive Growth](https://www.originhq.com/news/birgit-troy-chief-operating-officer): Origin Technology today named Birgit Troy Chief Operating Officer. Troy brings more than 25 years of experience scaling finance and operations at technology companies.
- [One Integration, and Claude Stops Being a Blind Spot](https://www.originhq.com/news/claude-compliance-api): Origin now integrates with Claude's Compliance API, bringing Claude Enterprise and Claude Platform activity into the same observability environment organizations use to understand the rest of their AI workforce.
- [Origin Is Now Available in the Anthropic Connectors Directory](https://www.originhq.com/news/origin-anthropic-connectors-directory): Origin is now listed in the Anthropic Connectors Directory—bringing your organization's AI observability data directly into Claude conversations so your team can act on it without leaving the tools they're already in.