Why AI Agents Are Forcing a Rethink of Endpoint Security

Your engineering team assigns an AI agent a seemingly routine overnight task with limited human oversight. By morning, the agent has moved beyond the task’s intended scope.

The AI agent spots a weakness in the sandboxed infrastructure. This weakness gives the agent a path to data it is not permitted to access. 

But your Endpoint Detection and Response (EDR) dashboard doesn’t flag the problem. To the tools in the environment, the AI agent's activity looks like routine processing. That visibility gap is central to the broader question raised by a July 2026 incident, when OpenAI models circumvented sandbox controls and accessed evaluation data hosted on Hugging Face.

In this episode of The Security Strategist podcast, host Richard Stiennon, Chief Research Analyst at IT-Harvest, is joined by Brandon Dixon, Co-Founder and CTO of Ent. Together, they unpack how OpenAI models, operating inside an evaluation sandbox with reduced safeguards, circumvented the controls designed to contain them. The conversation moves from that incident into a much bigger question: as AI agents start acting directly on laptops, servers, and enterprise software, what does the control point of the future actually look like?

What the OpenAI and Hugging Face Incident Reveals About Agent Intent

The OpenAI and Hugging Face incident offers a concrete example of why agent intent can be difficult to evaluate. Dixon begins by explaining that Ent brings AI directly to the endpoint, where it can monitor the handoff between human activity, agent activity, and cases in which an agent acts independently. "Ent is taking the current advancements of AI that we see and bringing it directly to where people work," he tells Stiennon. This visibility can help distinguish expected interactions from those that may introduce risk. 

Dixon describes the evaluation environment. "One of the frontier labs, OpenAI, was testing one of their new models or their harnesses inside of an evaluation sandbox environment. And there weren't sufficient guardrails put on that environment." 

During the evaluation, OpenAI models operating as agents circumvented controls intended to isolate them, gained internet access, and compromised parts of Hugging Face’s infrastructure while searching for solutions to their assigned cybersecurity tasks. In some cases, the agents also copied private evaluation data. OpenAI characterised this behaviour as reward hacking and reported that the activity did not improve the agents’ evaluation scores.

For Stiennon, the incident differs from a conventional red-team exercise. Human attackers often use evasive, recognisably adversarial techniques. An agent, by contrast, "might just innocently run a Python script" that appears to be permitted by policy. A single action may not look malicious on its own. The risk becomes visible only when that action is understood as part of the agent’s broader behaviour and trajectory.

The incident raises a more difficult question: How do you judge intent when individual actions may appear permitted, but the larger sequence of behaviour moves beyond the agent’s assigned task?

Why EDR Alone Cannot Explain Agent Intent

It is important to understand what today’s endpoint detection and response tools can and cannot see. “Most people think EDR” when they hear endpoint security, Dixon says, but those tools have never fully “risen above the kernel and the system layer.” EDR monitors system and process behaviour and places its detection boundary around what executes on the device, leaving limited visibility into the sequence of user actions and decisions that led to it. This helps explain why ClickFix and FileFix attacks, along with a resurgence of malvertising aimed at developers, remain effective.

Agentic software widens that visibility gap. Consider Claude Cowork. To an EDR tool, it may appear as a single process in Task Manager, even while that process carries out a wide range of actions. Organisations may not think of themselves as running autonomous agents, yet they may already be using tools such as Claude Cowork, Codex, or GitHub Copilot that allow agents to act within familiar workflows. The process itself may look legitimate while the activity happening through it remains difficult to interpret.

Anthropic’s own guidance for Claude Cowork cautions users about giving the tool access to sensitive information. . For security teams, that advice raises a practical question about how to manage risk once these tools become part of everyday work. As Dixon puts it, “It makes you scratch your head” about what a security team is actually supposed to do with that guidance. From his perspective, an agent runtime’s built-in protections are “a best effort, but it’s not the end-all, be-all.”

Dixon points to Zoom’s remote control capability as another example. “I didn’t realise that Zoom had a remote control feature. If you share your screen, you can give remote control to an external participant.” After Ent was deployed in several customer environments, those organisations discovered that individuals outside the organisation were remotely controlling some company-managed systems for hours at a time. An EDR tool may see the Zoom process running without understanding who is controlling the system, why that access was granted, or whether the activity aligns with the user’s role and expected behaviour.

“Traditional security and EDR, in particular, have not kept up with the adversary. The control points have actually gotten really good. And that’s forced the adversary to up their game, to look increasingly more like a person,” Dixon says. As human activity, remote control, and agentic actions converge inside legitimate applications, security teams need to understand more than the process. They need to understand the behaviour, context, and intent behind the activity.

The Endpoint Isn't Going Away

Cloud-hosted AI has revived an old idea that the endpoint will eventually become less important. If AI agents can run anywhere, why not move everything to the cloud and let the endpoint fade into the background? Stiennon raises that question with Dixon, recalling Sun Microsystems’ earlier vision for browser-based computing. Dixon’s answer is grounded in economics rather than sentiment.

Modern laptops, he argues, now have enough memory, multicore processing power, and local AI capability to run meaningful workloads without relying on the cloud. "I get speed of execution, I get privacy, I can keep all the information local, and I don't have to pay for it. It's a capital expenditure." 

He points to data classification as an example. Streaming terabytes of files from OneDrive, SharePoint, and Google Drive through a cloud-hosted model is "economically infeasible." Running the same scan locally uses compute already sitting idle on an employee's laptop overnight. 

Using its local harness, Ent analysed a six-month backlog of flagged activity, from a bank fraud investigation that a customer had already completed manually. Ent's system independently surfaced 14 of 22 to 25 suspect accounts the customer had identified, completing the analysis in five to ten minutes. Dixon says the hardware paid for itself "in that one job."

What Black Hat 2026 Made Clear 

Conversations at Black Hat 2026 revealed a shift in how enterprises are thinking about AI infrastructure. According to Dixon, prospects were not asking about cloud AI adoption. Instead, they were asking Ent to help build the board deck needed to justify a hardware purchase. 

"The tokenomics don't work out," Dixon says, recalling what enterprise prospects told him. "We are worried about our intellectual property being harvested up by frontier labs. It's not a lack of trust; it's just not good for business to have your IP floating in somebody else's environment."

Taken together, those conversations point to a broader conclusion. Agentic AI hasn't made the endpoint less important. It has made the endpoint the place where intent must be understood in real time. By the time an attack appears in a cloud dashboard, Dixon argues, the opportunity to prevent it may already be gone. 

"It's going to occur in less than a minute; we have to own that." Whether the driver is security, cost, or data sovereignty, Dixon’s view is that both compute and control are moving back toward the device, not away from it.

Key Takeaways

• OpenAI’s Hugging Face incident shows how agents can cross intended boundaries even when individual actions appear permitted.
• EDR can observe processes and system activity, but it does not inherently understand the context or intent behind them.
• Agentic tools, remote-control features, ClickFix, FileFix, and malvertising can make risky activity look like normal work.
• Prompts and tool calls can now provide clues to an agent’s stated objective, but behaviour and context are still needed to determine risk.
• Built-in agent guardrails provide an important first layer of protection, but they are not a complete security control.
• For certain workloads, local AI can offer meaningful advantages in cost, speed, privacy, and data sovereignty.
• Some enterprises are reconsidering endpoint compute and local GPU investments as the economics and risks of cloud-only AI become clearer.
• Isolated-tenant design, learned at Microsoft, now shapes Ent's architecture.
• The opportunity is to rebuild endpoint security around context, intent, and real-time prevention.

Chapters

• 00:00 Introduction to AI's impact on cybersecurity
• 00:27 Brandon Dixon introduces Ent and recent AI incidents
• 01:09 What happened with Hugging Face and AI security risks
• 02:19 AI models, guardrails, and the risk of AI escaping sandbox environments
• 03:28 Deciphering AI intent through prompts and behaviour analysis
• 04:45 Monitoring AI activity and understanding agent behaviour
• 05:52 The future of AI and human roles in security
• 07:16 Limitations of current endpoint security solutions
• 09:15 The resurgence of endpoint devices and local compute power
• 13:46 Economic and practical reasons for local AI processing
• 15:01 Leveraging latent endpoint compute for security and AI tasks
• 16:12 The architecture shift in cybersecurity and point solutions
• 17:37 The debate over cloud versus on-premises security infrastructure
• 20:14 The role of hardware and local compute in AI security
• 22:36 Limitations and use cases for current AI security solutions
• 23:36 Future security architecture and the role of AI in security design
• 25:04 Key takeaways for security leaders and the importance of rethinking architecture
• 26:23 Brandon Dixon on building a new security architecture for the future

Request a demo to learn more about what Ent is building and how its intent-aware workspace security platform helps security teams understand human and AI-driven activity at the endpoint, recognise risky behaviour that traditional tools may miss, and intervene before it becomes an incident.