Local models got good this year. Gemma 4's 12B runs agentic workloads in 16GB of RAM, GLM-5.2 tops the open-weight leaderboards under a permissive license, Qwen 3.6 does tool-calling that would've been frontier-only eighteen months ago. The "just run it locally" argument hit the top of Hacker News, and for once it wasn't cope — a model on your own hardware finally handles real work.
So teams are moving agents on-prem, and the pitch is almost always the same: local means private, private means safe. The first half is true. The second half is a category error that's going to cause incidents, because it quietly swaps a data question for a behavior question and hopes nobody notices.
TL;DR — Local deployment fixes exactly one thing: where your data goes. It does nothing for what your agent does. Prompt injection (50–85% success rates, architectural not model-level), silent provenance failures (the agent faking its own logs), and privilege escalation all survive the move to your hardware unchanged — and you've traded the provider's security team for none. Local agents are genuinely safe for a specific shape of task (bounded scope, trusted inputs, reversible or gated actions) and dangerously oversold for another (untrusted input, irreversible actions, regulated decisions). The dividing line isn't where the model runs. It's what the agent is allowed to touch.
