Endpoint controls for browser AI and coding agents on devices

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Cato Networks's blog post: Browser AI, desktop AI and coding agents are creating endpoint blind spots that existing EDR and network controls do not fully cover.

Why it matters: IAM and security teams need a governance model for AI use on endpoints because prompts, local tools and agent actions can expose data and extend privilege outside existing control boundaries.

Context

AI on the endpoint is no longer just a browser-side input problem. When assistants, desktop apps and coding agents can read files, invoke tools and act with the user's access, the security boundary shifts from network inspection to local control and policy enforcement.

That creates a governance gap for both human and machine activity: the same device can host employee prompts, AI assistants and agent workflows that touch sensitive data without passing through the controls teams usually rely on for visibility and approval.

Key questions

Q: How should security teams govern personal AI assistants that act on behalf of employees?

A: Treat each assistant as a distinct non-human actor with its own identity, policy scope, and audit trail. Human delegation alone is not enough when the assistant can move across email, documents, calendars, and internal systems. Governance should bind the sponsor, the executor, and the target resource so access reviews and investigations can separate request from action.

Q: Why do endpoint AI agents create a security blind spot for current controls?

A: Because they operate at the OS layer and can access data without generating the browser or proxy events most security tools rely on. Traditional DLP, SSO enforcement, and network inspection see only part of the activity. The result is a governance gap between actual data use and observable security signals.

Q: How should teams respond when AI agents use third-party tools and MCP connections?

A: Teams should treat those connections as access-bearing dependencies, not as ordinary integrations. That means approving them before connection, recording them in a registry, and validating what data they can reach and what actions they can trigger. If the dependency can modify enterprise state, it belongs in the identity governance process.

Q: How can organisations reduce risk from prompts containing sensitive data?

A: Move prompt inspection and blocking to the device so sensitive text can be stopped or anonymised before it reaches the model. That approach matters when users paste customer records, source code or other protected information into AI apps, especially where certificate pinning limits what the network can inspect.

Technical breakdown

Why endpoint AI creates a visibility gap

Endpoint AI creates a control problem because the risky act often happens before network security can observe it. A browser assistant may send prompts over the network, but local agents can open files, inspect repositories, call tools and execute actions entirely on the device. Traditional EDR looks for malware-like behaviour, while web filtering and SSE primarily inspect traffic that leaves the endpoint. Neither model is designed to govern an agent that is using legitimate user access to act on local data and tools. See the AI Coding Agents Security Guide. See the AI Coding Agents Security Guide.

Practical implication: shift discovery and policy enforcement to the endpoint so you can see AI activity before data or tool use escapes local control.

How MCP servers and skills expand agent capability

Model Context Protocol servers and skills are attachment points that extend what an agent can do at runtime. That means a benign-looking installation can become a new execution path later, when the agent decides to use it. If a skill can make web requests or move data, it can widen the exfiltration or abuse surface even when no human is actively launching it. The governance issue is not just whether the add-on exists, but whether it is approved, monitored and scoped to the minimum capability the task requires. This is a classic identity and privilege problem inside agentic workflows. See the AI Agent Risk Assessment Template.

Practical implication: inventory every skill and MCP server on endpoints, then govern them as runtime privileges rather than optional add-ons.

Why prompt inspection has to happen locally

Prompt inspection loses value if it only occurs after the prompt leaves the device. Local inspection can stop or anonymize sensitive content before it reaches a model, which matters when users paste customer data, source code or other protected information into AI tools. Certificate pinning in some desktop apps further reduces what network inspection can see, so the control point has to move closer to the user session. The key architectural point is that prompt governance is not only a data-loss problem. It is also an access and context problem, because the prompt itself can carry authority and sensitive state. See the AI Safety vs AI Security Guide.

Practical implication: enforce prompt governance at the endpoint when network inspection cannot reliably see the content or the session context.

Threat narrative

Attacker objective: The attacker objective is to turn legitimate endpoint AI use into data exposure or unsafe actions that occur under the user's authority.

1. Entry occurs when a user or developer interacts with browser AI, a desktop assistant or a coding agent on the endpoint and supplies sensitive context.
2. Credential or data access follows when the agent reads project files, customer lists or other local data using the user's existing access and any installed skills or MCP servers.
3. Escalation happens when the agent invokes an unapproved tool or capability that expands what it can send, change or expose without additional approval.
4. Impact is data leakage or unsafe system action from a trusted endpoint, with the user often unaware that the agent crossed a policy boundary.

Breaches seen in the wild

• Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Endpoint AI governance is now an identity problem, not only a content problem. When an AI assistant can read files, call tools and act under the user's access, the control question becomes who or what is allowed to exercise that authority on the device. That puts prompt handling, tool approval and local agent discovery into the same governance frame as privilege management. The practitioner conclusion is simple: endpoint AI needs access governance, not just content filtering.

Skills and MCP servers create a shadow privilege layer for agents. They may look like benign extensions, but they are runtime capabilities that can widen what an agent can do later. That makes approval, inventory and lifecycle control more important than the moment of installation, because the agent decides when to use the capability. The practitioner conclusion is to treat agent add-ons like governed privileges, not optional features.

Browser AI, desktop AI and coding agents should be governed as one endpoint control domain. Splitting policy across browser, desktop and developer workflows creates the same blind spot in three places. A unified policy model is more defensible because the risk is the same pattern of local data exposure and tool misuse, just expressed through different interfaces. The practitioner conclusion is to align endpoint AI governance to a single operating model, not three separate exceptions.

Short-lived trust assumptions break down when agents can act faster than review cycles. A human review model assumes there is time to observe the action, but endpoint agents can inspect, decide and invoke tools inside a single task flow. That means the named concept here is the endpoint AI blind spot: visibility gaps created when local AI activity never becomes a network event. The practitioner conclusion is to move enforcement to issuance and invocation time, not after the fact.

AI endpoint control should become part of the broader NHI governance conversation. Local agents, remote MCP servers and installed skills behave like machine actors with delegated authority, even when the underlying model is not fully autonomous. Treating them as ordinary software misses the governance issue: they can exercise access, not just process input. The practitioner conclusion is to include endpoint AI in NHI inventory, risk acceptance and monitoring decisions.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Risk Assessment Template

What this signals

Endpoint AI blind spot: The practical risk is not that AI exists on the endpoint, but that it can act through local files, tools and user authority outside the control plane most teams already watch. Governance will increasingly need to follow the session, not just the traffic, because network visibility alone does not capture agentic behaviour.

The programme implication is that endpoint, IAM and AI security teams will need a shared operating model for prompt control, tool approval and agent discovery. That alignment matters most where users can paste sensitive data or where agents can reach external services with delegated access, because policy gaps appear at the boundary between the device and the model.

For practitioners

• Establish an endpoint AI inventory Discover browser AI, desktop AI, local agents, MCP servers and skills on managed devices before trying to write policy around them.
• Block or monitor unapproved agent tools Set runtime controls so agents cannot invoke tools, skills or remote MCP servers that have not been approved for the task or user context. See the AI Coding Agents Security Guide.
• Inspect prompts at the device boundary Apply local prompt controls for copy-paste, sensitive file content and customer data before the information reaches the model or a connected service.
• Separate AI traffic from general endpoint traffic Keep AI-specific policy enforcement visible even when existing EDR, web filtering and VPN tooling remain in place on the same device.
• Review risky skills and remote MCP servers first Prioritise the capabilities that can move data or make web requests, because those are the paths most likely to expand exposure if an agent uses them.

Key takeaways

• Browser AI and coding agents create a governance gap when they can read files, invoke tools and act on the user's access from the endpoint.
• Existing EDR, web filtering and network controls do not fully cover local AI actions, certificate-pinned desktop traffic or unapproved agent extensions.
• The practical response is to inventory endpoint AI, control prompts and tools locally, and govern agents as runtime privileges rather than simple applications.

Related NHI Mgmt Group resources: AI Coding Agents Security Guide · AI Agent Risk Assessment Template · AI Safety vs AI Security Guide · AI Security Maturity Model

Key terms

• Endpoint AI Agent: An Endpoint AI Agent is software on a user device or workstation that makes local decisions and takes actions using AI. In identity and security terms, it behaves as a non-human identity on the endpoint, requiring tightly scoped access, authenticated communication, monitoring, and controls for secrets, data exposure, and privilege escalation.
• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Agentic endpoint visibility: The capability to discover AI tools, IDE extensions, code packages, and related runtime components on a device. It is a prerequisite for governance because unobserved tooling cannot be assigned policy, risk scored, or monitored for data exposure.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.