Workstation agents: are your controls keeping up with local AI risk?

TL;DR: Workstation agents run locally with user-level privileges, inherit credentials and reach internal networks, according to Repello AI, while 88% of organisations already report confirmed or suspected AI agent incidents and only 14.4% go live with full security or IT approval. The governance problem is not the model but the endpoint: identity, sandboxing, MCP controls, logging and runtime monitoring have to replace network-edge assumptions.

Editorial analysis by NHI Mgmt Group, based on content published by Repello AI: “What Is Workstation Agent Security? The 2026 Enterprise Defense Stack”.

By the numbers:

• 88% of organisations report confirmed or suspected AI agent security incidents in the past year.
• Only 14.4% of AI agent deployments go live with full security or IT approval.
• Only 47.1% of deployed agents are actively monitored.

Key questions

Q: How should security teams govern agent access on developer laptops and servers?

A: Use the same runtime identity and policy model on both environments, because the governance problem is the same once an agent can access cloud services or internal data.

Q: Why do local AI agents create more risk than browser-based AI tools?

A: Local agents can inherit endpoint permissions, active sessions, and filesystem access, which means they can execute actions directly in the development environment.

Q: What are the first signs that workstation agent controls are failing?

A: Look for unsanctioned agent installs, shared credentials across users, unexplained MCP server connections, and active agents that are not being monitored.

Practitioner guidance

• Assign each workstation agent its own identity Issue a distinct service principal, short-lived token, or workload identity certificate per agent instance and stop credential inheritance from the human user.
• Enforce OS-level sandboxing by default Restrict filesystem, network, and process access with kernel or container controls so the agent cannot widen its own execution scope at runtime.
• Gate MCP tools individually Authorize each tool call separately, maintain a server inventory, and block unknown or unattested MCP servers before the agent can connect.

Bottom line: Workstation agents are local identity-bearing processes, so the core risk is inherited authority on the endpoint rather than prompt leakage in transit.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →