Local LLM security starts with an inventory problem: enterprises cannot govern models and agents they have not found, and local deployment generates nothing that finds them. Hosted AI leaves a trail: a contract, an invoice, an API key, a vendor to call. Local AI leaves a process.
Terms
A local model is a model whose weights sit on hardware you operate, from a workstation to a datacenter GPU host. A runtime is the software that loads and serves it, such as Ollama, LM Studio, or llama.cpp. An inference endpoint is the network-listening interface a runtime exposes. A local agent is the software driving the model: a coding assistant, an IDE integration, a workflow tool, running with its operator's access.
The realistic starting state
Inference runtimes are on engineering workstations because local models became good and free. A fine-tuned model sits on a lab server someone set up for one experiment. A team operates its own inference endpoint that no inventory lists. None of this is malicious, and all of it is ungoverned: unverified artifacts, agents with the engineer's own access, and no record of what any of it has touched.
What the inventory records
| Field | Why it matters |
|---|---|
| Process and runtime, with version | The thing that is actually executing, and whether it carries known vulnerabilities |
| Model artifact hash | The exact artifact in service; a name identifies a family, a hash identifies an artifact |
| Bind address and port | Loopback-only or network-exposed |
| Endpoint owner | Who answers for it |
| Consuming agents | What is driving the model, and with whose access |
| Project assignment | Which boundary governs it |
| Policy state | Audit-only, authorized, or contained |
Discovery methods and their blind spots
Process-level endpoint telemetry sees the runtimes and agents executing on enrolled machines, including agents whose traffic never leaves the host; a local agent talking to a local model over a loopback address produces nothing that leaves the host, and off-host monitoring cannot attribute loopback traffic to a process. Network scanning finds listening inference endpoints, sanctioned or otherwise, but only the exposed ones. Artifact scanning identifies model files on managed storage by hash.
Every method has the same boundary: no endpoint technology, EDR included, sees software on machines where it is not installed. Ephemeral containers, unmanaged personal devices, and contractor hardware are outside any sensor's reach, and an inventory that pretends otherwise overstates its own coverage. The design that survives this fact puts enforcement on the other side. When the protected components of a project verify their counterpart before admitting a connection, an unenrolled endpoint has no path into the boundary, whatever is running on it. The shadow agent you cannot detect is also an unauthorized one with zero reach into project data. Detection coverage is worth maximizing, but the hard requirement is enforcement that does not depend on it.
From found to governed
Discovery feeds authorization directly. A high-sensitivity deployment places an unknown runtime at zero reach until it is assigned to a project boundary with a declaration attached; a discovery-mode pilot can begin in an audit-only posture while the inventory fills in. What no posture permits is the silent middle: an agent that is not in inventory never inherits authorized reach merely because it runs under an authorized user. The sequence is discovery first, then authorization, then constraint.
Ollama, specifically
Ollama binds to 127.0.0.1 on port 11434 by default and ships with no authentication layer at all. Anyone who can reach the port can run inference, list models, and pull or delete them through the REST API. The one-line change that tutorials recommend for remote access, setting OLLAMA_HOST to 0.0.0.0, removes the loopback binding and exposes the API to the network, and at internet scale the result is documented: SentinelLABS and Censys counted roughly 175,000 exposed Ollama servers in January 2026, many likely exposed through permissive remote-access configuration rather than attack. A 2026 vulnerability (CVE-2026-7482, CVSS 3.1: 9.1) allowed unauthenticated memory reads, exposing environment variables, API keys, system prompts, and conversation data, until the 0.17.1 patch. The governance translation: treat every discovered Ollama instance as an unauthenticated inference server. Verify what it serves by hash, confirm the bind address is loopback unless the endpoint is explicitly authorized, keep the runtime patched, and give any network-exposed instance the full inference-server posture: default-deny egress, a reverse proxy with authentication in front, and an entry in the inventory with an owner.
LM Studio, specifically
LM Studio's server listens on port 1234 and binds to 127.0.0.1 by default, reachable only from the same machine. The Serve on Local Network setting, or a non-loopback LMS_SERVER_HOST, binds it beyond localhost, and LM Studio's own documentation recommends enabling its API token authentication for any bind other than 127.0.0.1. Two additional settings matter to a security review: the server can be configured to let API clients invoke MCP servers, including servers defined in the local mcp.json, which extends an inference endpoint into a tool-execution endpoint; and users bridge instances across machines with the LM Link feature, an end-to-end encrypted overlay that opens no inbound ports and creates a path a conventional network diagram will not show; the endpoint is still on the network, and inventory and architecture reviews account for the overlay path. The governance translation: a discovered LM Studio instance is a workstation service until someone flips one setting, after which it is shared infrastructure. Inventory it, record the bind address and whether authentication is on, and treat MCP passthrough as a declared capability requiring authorization, not a default.
A local-runtime assessment, in five checks
For each discovered runtime: confirm the artifact hash against the registry; confirm the bind address, and that any non-loopback bind is authorized, authenticated, and owned; confirm the runtime version is current; enumerate the consuming agents and their project assignment; and confirm the host's egress posture matches an inference server's, deny by default.
Where the control plane fits
Ensage AI anchors this practice from both sides. On enrolled endpoints, zLink detects agents and local runtimes at the process level and identifies model artifacts by hash. On the protected side, enclave enforcement admits only enrolled, authorized counterparts, so an endpoint without zLink has no path into project data regardless of what runs on it.
