A local model runtime is software that runs an AI model on the device itself instead of sending every request to a remote cloud service. It may appear as a standalone process, a development tool, or a bundled component inside an application. Because the model executes on the endpoint, it can process prompts, files, and code locally, which changes both the data flow and the security boundary.
In cyber security, this matters because local runtimes can be missed by traditional software inventories that only list installed desktop apps. Defenders need endpoint telemetry to see whether a model is active, what data it can access, and whether it is allowed to connect to internal systems or external APIs. Attackers can abuse the same flexibility by hiding AI-assisted behavior inside an endpoint process, while defenders can use the same runtime model to reduce cloud exposure and keep sensitive content on-device. The key question is not just whether AI is present, but where it is actually running.