Enterprises are moving inference in-house for privacy and cost. The property that got it approved, that nothing leaves the host, is the property that hides it from AI security tooling built around the cloud.
Enterprises are moving inference onto their own machines. Open-weight models running through local runtimes, on workstations, on GPU hardware under a desk, and on servers inside the perimeter.
The drivers are not exotic. Sensitive data never leaves the environment, so privacy and legal teams actively encourage it. There is no per-token bill, which matters now that frontier API spend has become a line item finance wants capped. There is no third-party processing agreement to negotiate and no vendor review cycle to sit through. Latency improves. The thing works offline. And developers were running local models before anyone formally approved it.
Every one of those is a good reason. None of them is a security problem on its own.
The security problem is structural. The property that makes local inference attractive, that nothing leaves the host, is the same property that makes it invisible to AI security tooling designed around the cloud.
AI security tooling is converging on two approaches, and both assume the agent introduced itself first.
The first is enforcement at the decision point. Evaluate what an agent is about to do, then permit it, block it, or end the session. Real capability, real engineering, and it addresses a real risk on the platforms an enterprise sanctions and configures.
The second is discovery, scoring, and audit evidence. Find the models, services, and infrastructure, attach a risk score, produce a report that satisfies the board and the regulator. Useful work that maps to a mandate most security leaders now carry.
Now put an agent built on a local open-weight model in front of each one.
There is no cloud tenant, so there is nothing to enroll. There is no vendor API, so there is nothing to integrate with. There is no admin console and no enterprise agreement, because there is no vendor on the other end. Enforcement platforms attach to managed AI platforms, and this agent is not one.
Discovery has the same problem from a different direction. There is no egress to a recognizable AI provider domain, because the inference is happening on the machine. Network-based detection has no traffic to key on. Cloud-side discovery has no account to enumerate. A scan finds a binary and some large files on disk, with no CVE attached to any of it.
The agent is not evading anything. It is simply built in a way that the detection model does not account for.
The process.
A model runtime executing on the asset. Loading weight files. Holding accelerator resources. Spawning tool calls. Reading local files. Writing output that gets executed.
That is all directly observable, but only by something running on the host that watches behavior rather than registration. Not a scan, which sees what is installed at a point in time. Not an integration, which sees what agreed to be integrated. Execution, as it happens, on the asset.
This is the same observation problem Spektion already solves for the rest of the software estate, applied to a new class of software. An AI agent installs, executes, spawns child processes, reads files, calls tools, and reaches credentials. It is software. The exposure model does not need a new category for it.
An AI agent's risk is not only the decisions it makes. It is what the agent can reach.
The privilege the process holds. The stored secrets sitting in files it has read access to. The component weaknesses in its own software. The network paths open to it. The executable it wrote to disk at 2am and then ran.
None of that has a CVE. None of it appears in an AI inventory built from API enumeration. And it is exactly what determines the blast radius when an agent is compromised or manipulated into acting against you.
Spektion's sensor observes execution state, privilege level, network exposure, and blast radius for every piece of software running in the environment, and grades exploitability on that evidence rather than on a global score. AI workloads enter that same model. Not a separate AI program with a separate rating competing for the same remediation hours, but one queue with one set of evidence.
Local inference is being adopted for exactly the reasons that place it outside the reach of cloud-oriented AI governance, and it is being adopted by the people closest to the data. That gap widens as adoption grows, not despite it.
There are two questions worth putting to any AI security vendor, including us.
How do you find an AI agent that was never registered with you?
How do you find an agent running on a local open-weight model, where there is no tenant, no API, and no traffic leaving the machine?
If the answer to either one starts with an integration step, the coverage stops where the integration does.
Many exploitable weaknesses never get a CVE. Book a runtime exposure assessment and Spektion will show what's actually exploitable across your endpoints.