Local AI agents just left the desktop. The security question is the one that matters now.

Two weeks ago I wrote about Apple pitching enterprise buyers on desktop Mac Studios with “no cost per token.” Today Microsoft and Nvidia unveiled the same pitch for something you actually carry around: a Surface Laptop Ultra built on Nvidia’s RTX Spark chips, with up to 128 GB of unified memory, capable of running 120-billion-parameter models entirely on-device. Two different operating systems, converging on the same idea from opposite ends — the laptop in your bag can now do work that used to require a data center.

That part is the continuation of a story I’ve already told. The part that’s actually new, and worth taking seriously, is what Microsoft built alongside the hardware: a real attempt at containing what happens when the thing running locally isn’t just a model answering questions — it’s an agent that can act.

Why this is a different risk than local inference

A model running locally and answering your questions is one risk profile: the data stays on your machine, which is the whole point of private AI, and the worst case is usually “the model said something wrong.” An agent with broad file-system access, browser control, and stored credentials, taking multi-step autonomous actions, is a fundamentally different risk profile — the worst case now includes “the agent did something wrong,” potentially before anyone was watching. And unlike a cloud deployment, there’s no centralized security team’s guardrails sitting between the agent and your machine. Whatever protection exists has to live on the device itself.

Microsoft clearly knows this is the real problem. Windows now ships with Agent Workspaces — sandboxed sessions where an agent runs isolated from the rest of your system — paired with Microsoft Execution Containers (MXC), a policy-driven model where a developer explicitly defines what an agent is allowed to touch, enforced by Windows itself at runtime, not by the agent’s own good behavior.

Why that’s a real answer, and also not a finished one

Give Microsoft credit here: this isn’t security theater bolted on after the fact, it’s an actual OS-level primitive built specifically for the problem agentic AI creates. That’s the right instinct, and it’s a more serious answer than “trust the model to behave.”

But a permission boundary is only as good as how correctly it gets scoped, and that’s a human problem, not a solved one. Every sandboxing model in computing history has had the same failure pattern: not that the isolation mechanism itself breaks, but that someone grants a scope broader than they meant to, because the agent “needed” one more permission to finish a task. An agent that can read your files to help you organize them and one that can also quietly exfiltrate them look identical from inside a container that was scoped too generously. Reuters flagged exactly this as the real test of the platform, and I think that’s correct — the hardware story is basically settled at this point; the containment story is not.

The honest economics footnote

Worth noting plainly: this isn’t happening against a backdrop of falling hardware costs. Nvidia’s own DGX Spark just jumped roughly 75% to $6,950 for the 128GB configuration, driven by a genuine industry-wide memory price surge as AI data center demand competes for the same supply that feeds consumer hardware. Nvidia’s response — a cheaper 64GB tier at $4,999 — is a reasonable one, but it’s a reminder that “run it locally” doesn’t mean “run it for free forever.” The cost-per-token argument still holds for steady workloads; it’s just not a free lunch on the hardware side either, right now.

What this means if you’re the one deploying it

If your business starts adopting on-device agents — and this announcement makes clear that’s where the industry is pushing, hard — the decision isn’t just “which laptop” or “what’s the ROI.” It needs an actual security review: what can this agent touch, who scoped that permission, and what happens if it’s wrong. That’s not a hypothetical add-on to private AI adoption, it’s a prerequisite, and it’s exactly the kind of review that should happen before an agent gets deployed, not after something goes wrong. A readiness audit done right covers this specifically — not just whether you can run AI privately, but whether you’ve actually thought through what it’s allowed to do once it’s running.