Local Models Are the Insider Risk Nobody Logged
A capable open-weight model runs on a laptop with no network calls. That solves the data-leaves-the-company problem and creates a data-leaves-without-a-trace problem.
Security teams spent two years building controls around AI traffic leaving the network: gateway inspection, approved providers, DLP on prompts. Open-weight models good enough for real work now run on ordinary hardware, and none of that traffic exists.
Why people run them
Mostly for good reasons. Confidential material they were told not to paste into a hosted tool, offline work, latency, cost, or a legal restriction on a specific dataset. Treating this as misconduct misreads the situation and pushes it further underground.
What the risk actually is
- Invisible processing of regulated data. A model summarising a customer database locally leaves no record that the processing happened, which is a documentation problem under most privacy regimes.
- Bulk aggregation. Local tooling makes it easy to point a model at an entire export. The export is the risk event, and it looks like ordinary file access.
- Unvetted weights. Models are pulled from public hubs. Serialisation formats have a history of code-execution issues, and few users check hashes.
- Output laundering. Confidential content, reworded by a local model, defeats content-matching DLP downstream.
A workable response
1. Inventory before policy
Endpoint telemetry can identify local runtimes and model files by process and path. Find out what is actually installed before writing rules about it.
2. Sanction a path
An approved local runtime with vetted weights, installed through your own software channel, removes most of the reason to improvise.
3. Move detection to the data, not the prompt
You cannot see the prompt. You can still see the export, the mount, the copy to the local directory. Bulk data movement onto endpoints is the observable and it was always the better signal.
4. Verify the weights
Pin model artefacts by hash, mirror them internally and scan them, the same way you already treat container images.
5. Write it into the AI policy explicitly
Most AI policies say "do not paste confidential data into external tools". Almost none say anything about local models, which staff reasonably read as permission.
The gateway log was never the control. It was just the place the control happened to be easy.
