The first change is that agents are moving from demos to production. A year ago, most “AI agent” announcements were slide decks and carefully staged videos. Now enterprises are asking how these systems fit into permissions, audits, and day-to-day operations.
Small models running on a laptop are getting good enough for real work, and they keep your data on your machine.
Privacy might end up being the feature that wins. Would you run a local model for sensitive work?
Treat everything an agent reads as untrusted input: web pages, PDFs, emails, even tool outputs.
If your agent can read it and act on it, an attacker can write to it.