Local AI Agents: Private, but Are They Secure?

Running AI on your own computer keeps your data away from cloud providers, but it does not make you safe. The moment a local AI agent can read your files, open your email and run commands, anyone who can put text in front of it may be able to steer it, and that is a security problem privacy alone does not solve.

This article explains why people and companies are moving AI onto their own machines, what went wrong with one popular local agent, and how to get the privacy benefit without opening a back door.

Why are people running AI locally?

Privacy and control. A model that runs on your own device does not send your prompts, documents or code to a provider. Desktop apps such as Jan, a free and open-source alternative to ChatGPT, let people download open models and run them locally.

There is also a workplace reason. Microsoft and LinkedIn’s 2024 Work Trend Index found that 78% of people who use AI at work bring their own tools. Some organisations see local AI as a way to give staff AI without sending company data to outside services.

Is local AI secure?

A local chat app that only answers questions has a small attack surface. A local agent is different. It acts: it reads files, browses, sends messages and runs commands. That turns two well-known risks into serious ones.

Indirect prompt injection. Researchers described in 2023 how instructions hidden in content an AI reads, such as a web page or document, can take over its behaviour. OWASP ranks prompt injection first among risks for applications built on large language models, and notes that indirect injections arrive through external sources such as websites or files.

Excessive agency. OWASP’s LLM06 names the root causes of damage when an agent is misled: excessive functionality, excessive permissions and excessive autonomy. An agent with full access to a laptop has all three.

The costs are real. IBM’s Cost of a Data Breach Report 2026 found that incidents involving prompt injection against an organisation’s AI led to average losses of USD 5.89 million.

What happened with Clawdbot and OpenClaw?

In early 2026 an open-source AI assistant, known in turn as Clawdbot, Moltbot and OpenClaw, went viral because it could carry out tasks by itself on the user’s own computer. Security researchers soon raised alarms. Tenable described how, because the tool reads emails, chat messages and web pages, attackers could send messages that trick it into running unauthorised commands, and how keys stored by the agent could be stolen to take over accounts.

Tenable’s advice was plain: scope the agent’s keys and tokens to allow just enough access and disallow dangerous actions, and because the agent can be added to group channels where it reads untrusted messages, grant access only to trusted people and channels.

Analysis: the lesson is not that one tool was badly made. Any agent that mixes untrusted input, private data and the power to act is exposed in the same way, wherever it runs.

Privacy or security: do you have to choose?

No, but you have to design for both. Local processing protects data from the provider. Isolation and limited permissions protect data from the agent. The cloud is not automatically worse: a well-run service can apply monitoring and patches that a personal laptop never gets. The right choice depends on the data, the task and who will maintain the setup.

How can you use local AI agents safely?

1. Separate chat from action. Use a plain local model for private questions; turn on agent tools only when needed.
2. Grant the least access. Give the agent one working folder, not your whole disk, and no saved passwords or keys it does not need.
3. Isolate it. Run agents in a container or virtual machine so a misled agent cannot reach the rest of the system.
4. Keep a human in the loop. Require approval before it runs commands, sends messages or contacts the internet.
5. Limit untrusted input. Do not let an agent with powerful tools read public channels or unknown email.
6. Update and watch. Apply security updates quickly and log what the agent does.
7. Set a company policy. If staff bring their own AI, give them approved tools and clear rules rather than a ban they will work around.

For how to structure AI systems so that one compromised part cannot reach everything, see One Big AI Model or Many Agents?.

Frequently asked questions

Is local AI more private than cloud AI?

Usually, for the data itself: a model that runs on your own device does not send your prompts or files to a provider. Privacy is not the same as security, though. An agent with access to your files, email and command line can still be tricked into leaking them.

What is indirect prompt injection?

It is an attack in which instructions are hidden in content the AI reads, such as a web page, email or file. OWASP lists prompt injection as the top risk for applications built on large language models.

What went wrong with Clawdbot and OpenClaw?

The open-source agent known in turn as Clawdbot, Moltbot and OpenClaw drew security warnings in early 2026. Tenable described indirect prompt injection through emails, chats and web pages, and stolen API keys, and advised granting the agent access only to trusted people and channels.

How can I run a local AI agent safely?

Give it the fewest permissions it needs, run it in an isolated container or virtual machine, require your approval before it runs commands or sends data, keep it away from untrusted content where possible, and keep it updated.

References

1. Jan, Open-source ChatGPT replacement — An example of a free, open-source desktop app that runs AI models locally.
2. Tenable (2026), Agentic AI Security: How to Mitigate Clawdbot, Moltbot, OpenClaw Vulnerabilities — Indirect prompt injection through emails, chat messages and web pages; exposed keys; advice to grant access only to trusted people and channels.
3. Greshake et al. (2023), Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — The research paper that described indirect prompt injection.
4. OWASP (2025), LLM01:2025 Prompt Injection — Defines direct and indirect prompt injection, including instructions hidden in websites or files.
5. OWASP (2025), LLM06:2025 Excessive Agency — Root causes: excessive functionality, excessive permissions and excessive autonomy.
6. IBM (2026), AI-powered adversaries and the enterprise risk challenge (Cost of a Data Breach Report 2026) — Prompt injection incidents averaged USD 5.89 million in losses.
7. Microsoft and LinkedIn (2024), AI at Work Is Here. Now Comes the Hard Part (Work Trend Index) — 78% of AI users bring their own AI tools to work.