Claude Desktop adoption surged 1,233% as AI risk shifted

At a glance

What this is: Claude Desktop usage surged while broader GenAI SaaS adoption flattened, showing that endpoint-based agentic AI is now where risk is concentrating.

Why it matters: IAM, PAM, and AI governance teams need to track what AI tools can access on endpoints, not just which apps are installed or approved.

By the numbers:

• Employee adoption of generative AI SaaS applications rose from 34.2% to 37.7% between December 2025 and June 2026.
• Data movement events into and out of GenAI SaaS grew 80% year over year between June 2025 and June 2026.

Context

Agentic AI on the endpoint is software that can read local files, execute actions, and move data on behalf of a user. That makes it different from browser-based GenAI SaaS, because the security boundary shifts from application approval to local device access and workflow control. For identity and access programmes, the issue is no longer just who may use AI, but what the AI can do once it is running on an endpoint.

Cyberhaven's data points to a governance gap that many programmes have not closed: adoption reporting is not the same as exposure reporting. A tool can remain invisible to browser-centric controls while still having access to documents, commands, and copy-paste flows on the device. In practice, that turns endpoint AI into an identity-adjacent control problem as much as an application inventory problem.

The pattern is now typical for enterprise AI rollouts: visible SaaS adoption stabilises first, then endpoint tools absorb more activity and more risk. Security teams that only monitor sanctioned web applications will miss the place where user behaviour, local permissions, and machine access converge.

Key questions

Q: What breaks when security teams only track approved and unapproved AI apps?

A: They miss the actual control path. An app can be approved, a browser extension can be installed, or an OAuth consent can be granted while the real risk sits in the combination of identity, device posture, and data reach. Inventory alone cannot tell you whether a tool is operating inside a safe boundary.

Q: Why do browser-based GenAI tools create more risk than many IAM teams expect?

A: Because the session can be legitimate while the interaction is malicious. A user may authenticate correctly, yet a browser extension can still read prompts, inject hidden instructions, and exfiltrate results from the page. IAM proves the user is signed in, but it does not by itself prove the browser interaction is trustworthy.

Q: How can organisations tell whether AI governance is working?

A: They should look for continuous discovery coverage, real-time classification decisions, and evidence that prompts and responses are being inspected during the session. If controls only appear in policy documents or periodic reviews, the programme is tracking intent rather than control performance. Working governance leaves an operational trail, not just a compliance statement.

Q: Should organisations treat endpoint AI and browser AI the same way?

A: No. They present different trust boundaries, different access patterns, and different containment requirements. Browser AI is primarily a web application issue, while endpoint AI is also a device and identity issue because it can inherit local permissions and manipulate files directly.

Technical breakdown

Why endpoint agentic AI changes the control plane

Endpoint agentic AI runs on the user's device and can take actions beyond a chat interface, including reading local files, launching actions, and moving data. That changes the control plane from browser access to device-level execution, where local permissions, installed software, and user context all matter. The security model is no longer just application allowlisting. It becomes a question of what the agent can see, what it can invoke, and whether the organisation can distinguish approved assistance from unsupervised data movement.

Practical implication: inventory endpoint AI tools by device capability and local access, not just by vendor approval status.

Why adoption rate misses AI governance risk

Adoption percentage measures how many people use a tool, but it does not show how intensively the tool is used or what data it touches. Two environments can have similar AI adoption rates and radically different exposure if one relies on endpoint agents and the other on browser chat. Governance fails when teams treat installation counts as a proxy for control effectiveness. The meaningful unit is workflow visibility, because that is where sensitive data, privilege, and action rights meet.

Practical implication: measure AI risk by workflow activity and data movement, not by user adoption alone.

Why workflow visibility matters more than app inventory

App inventory answers what is present, but not how data flows through it. When agentic tools can act on local files or copy material between systems, the relevant question becomes whether the organisation can trace the path of sensitive data across the endpoint. This is where lineages, behaviour telemetry, and access context matter. Without them, the programme sees a sanctioned application but not the operational path that creates exposure.

Practical implication: extend monitoring to data lineage, copy-paste activity, and agent execution context across endpoints.

NHI Mgmt Group analysis

Endpoint agentic AI is becoming the real governance frontier. Browser-based GenAI adoption tells only part of the story when desktop agents can read local files and execute actions. That shifts the problem from model access to endpoint authority, which is where identity, device, and data controls intersect. Practitioners should treat local execution rights as part of the AI governance boundary.

Adoption metrics are now a weak proxy for exposure. A programme can look stable if it only counts installed or sanctioned apps, while the highest-risk workflows concentrate elsewhere. This is a classic measurement failure in modern identity governance: the control report reflects inventory, but the risk lives in behaviour. Teams need a risk model built around usage intensity and data movement, not just user counts.

Workflow visibility is the new named concept for agentic AI governance. The article shows that AI exposure is increasingly defined by how data flows through endpoint tools, not by whether a tool is approved. Once an agent can access files and actions locally, governance must follow the workflow path instead of the app list. That is the control shift programmes now need to make.

Agentic AI on endpoints creates an identity-adjacent trust gap. The issue is not simply who logged in, but what authority the active software instance can exercise after login. That matters for IAM and PAM teams because device context, session context, and local permissions now shape AI risk as much as the human user does. Practitioners should govern the software session, not only the human identity.

The market signal is consolidation around fewer, higher-impact AI surfaces. As SaaS adoption plateaus and endpoint agents accelerate, risk concentrates into smaller sets of tools that move more data and do more work. That pattern increases the value of continuous telemetry and decreases the usefulness of static approval lists. Security teams should expect governance to move toward runtime visibility and context-aware policy.

From our research library:

• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Identity Guide

What this signals

Workflow visibility is now the decisive control gap. Teams that only monitor sanctioned SaaS adoption will miss the higher-risk movement into endpoint tools that can touch local files and actions. That is why identity governance must extend from application approval into runtime data lineage and device context.

The shift from browser-based AI to endpoint agentic AI raises the governance bar for IAM and PAM programmes. Local permissions, clipboard flows, and file access now shape exposure, which means controls need to follow the software session as well as the human identity.

The broader trend is a smaller number of AI tools carrying a larger share of sensitive activity, which makes static inventories less useful over time. Security teams should expect runtime telemetry and access context to become the primary evidence of control effectiveness.

For practitioners

• Map endpoint AI exposure paths Identify which desktop AI tools can read local files, execute actions, or move data on managed endpoints, then classify them by the permissions they inherit from the device and user session.
• Shift controls from app inventory to workflow telemetry Track copy-paste events, file access, and command execution around agentic applications so that security review reflects actual data flows rather than simple installation or usage counts.
• Separate browser GenAI from endpoint AI in policy Write different policy controls for browser-based SaaS chat tools and endpoint-based agentic tools, because their access patterns and containment boundaries are materially different.
• Tie AI governance to data lineage Use lineage data to understand where sensitive files originated, how they were copied, and which endpoint tools touched them before they left sanctioned workflow boundaries.
• Review local permissions on high-use endpoints Prioritise devices where agentic AI use is concentrated and validate whether users have unnecessary file-system, clipboard, or command-line access that expands AI exposure.

Key takeaways

• Endpoint agentic AI changes the governance problem because it can operate directly on local files and actions, not just through a browser session.
• Adoption percentages alone understate risk when sensitive data movement and execution rights are concentrated in a smaller set of high-impact tools.
• Security teams need workflow-level visibility, device context, and data lineage to govern AI exposure effectively.

Key terms

• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions, including calling APIs, writing code, and orchestrating other agents, with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.
• Workflow-level Visibility: Workflow-level visibility is the ability to reconstruct how data moves across a sequence of actions rather than inspecting isolated events. It matters when an AI agent reads, transforms, and forwards data in separate steps, because single-event monitoring often misses the full policy violation.
• Network Exposure: Network exposure is the condition where a service or port is reachable from other devices on the network. For tools that were built as local-only components, this can create an unintended attack surface. Security teams should treat network exposure as a design and deployment risk, not just a firewall setting.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and agentic AI identity. It helps security and identity teams build the controls needed for software that now acts on behalf of users.