Margin of Safety #61: Beyond the Guardrail… Hardware, Agents, and the Future of the Endpoint

Can legacy operating systems safely contain autonomous AI and agents? Maybe not, and if not, what does that mean for the endpoint?

It doesn’t take a Gartner subscription to notice that cybersecurity and investing both move in waves, and one upcoming wave seems to be the reinvention of endpoint security. This has us wondering; how do endpoints and agentic interact, and what’s the future of the endpoint in an agentic world?

We think endpoints will change. So far, the impact on AI on hardware has been mostly felt in the datacenter side of the world, where costs are exploding and politics are becoming complicated. But looking back over the last 30 years, we observe that software and hardware revolutions are often coupled, with disruptive waves hitting both sides. The rise of Linux and commodity x86 brought both a new OS and radical changes in hardware consumption; cloud not only disrupted hardware consumption semantics (and providers) but also enabled horizontal scaling to go mainstream as a software architecture. On the consumer side, it’s difficult to separate the rise of mobile hardware with that of the software powering mobile app stores and payments. The exact interactions vary on a case-by-case basis, but the pattern is that in mature ecosystems, hardware and software exist in tandem: both are explicitly engineered to match the needs and capabilities of the other. In such an environment, it’s hard to radically shift the behaviors of one side without creating new winners (and losers) on the other.

So: what radical shifts are likely on the endpoint because of changing software needs? There’s already a hint in Apple’s multi-month backlog for Mac Minis, which occurred due to a combination of the industry-wide memory crunch and Minis becoming a preferred device on which to isolate Open Claw style agents. But we think the massive shift towards desktop agents will produce even bigger ripples in the market. This stems from what we see as a core challenge of today’s desktop agents – Claude Code & Codex, Cowork, etc. Namely, they’re running in a user environment which is ultimately not well designed to guardrail complex software that depends on broad system interaction and doesn’t closely track user action – eg, agents. Instead, agents are running within a user’s identity on legacy desktop OSes where permission systems were never designed for these sorts of delegated usage patterns. As a result, we’re currently seeing numerous companies investing in ways to weld guardrails onto agents, and the agents themselves are developing increasingly complicated ways to prompt and manage task-level permissions. But this is still all on top of the underlying OS model, and we think it’ll be hard to get right while maintaining current OS semantics.

In this context, the desktop model can be an outlier among modern software. In other areas, like mobile OSes, the cloud and K8s, or even ZTN and network isolation, the last 10-20 years have seen a shift towards distributing and running workloads in manners that allow for more granular permissions and tighter controls over inter-workload interaction. This has been driven both by operational concerns – it’s easier to update things when you can reason about small pieces and don’t need to reckon with dependency spaghetti – and also by security ones, where various types of workload isolation (but particularly network) can be required for compliance.

That naturally leads to the idea – and we’re starting to see a few interesting startups invest in this direction – of pushing hard on task-level isolation for agents. We can imagine a different model to the status quo, in which desktop agents don’t have such broad local permissions, and instead launch tasks into explicit sandboxes, provisioned with just the level of access the task demands. This would have advantages ranging from security (stricter permissioning, a well defined blast radius, and substantially limiting the ability of task-level prompt injection or other forms of agentic compromise to spread) to hardware (you can move heavy weight or long running tasks off the endpoint and into the cloud, allowing for both pooled ephemeral resource consumption and eliminating the need for software or gadgets that stop a laptop from sleeping while an agent runs).

But if this comes to pass, what does it mean for the endpoint? The short answer is complexity, especially for measurement and orchestration. In a world where sandboxes don’t align to existing desktop OS semantics, activity potentially spans more endpoints, and potentially with more diversity of form factor (more on this in a future post). It simplifies some security problems if more workloads move to form factors with less rich execution capabilities, but other security problems are enhanced by the fact user telemetry must account for more devices and more interaction modalities. Getting such telemetry right is critical for security investigations and forensics. Additionally, the infrastructure required to correctly manage and provision sandbox credentials is non-trivial and increases the security risk surface, especially if it’s done poorly. These complexities mean that reasoning about users up and down the stack – from PAM to ZTN to current EDR solutions – become harder.

We think this translates to very specific points for security builders (or buyers). First, in much the same way that the current vulnerability wave rewards retooling for speed (to quote the inimitable Phil Venables[1]), endpoint security strategies should explicitly favor flexibility in the face of future uncertainty. Second, prepare for fragmentation of user workloads. We think it’s unlikely that in 2 years, most users will be running highly privileged agents with identical scope to the users themselves. One way or another, guardrails will necessarily force some degree of additional segmentation, because an effective guardrail must separate agentic tasks from those that are directly human initiated and controlled. This fragmentation may be local (eg, multiple sandboxes on one device), but there’s a good chance it involves work increasingly spanning devices and networks – in fact, this is already happening when you consider some tasks shifting to remote MCP servers. Finally, prepare for longer term shifts in device form factor. If we see as much disruption on the endpoint side as we’re seeing on the software side, it could culminate in new viability for alternate endpoints – we think Chromebook style thin clients are the most likely winner, since they benefit strongly from offloaded compute. This would mean that not only does endpoint security need to adapt to fragmented execution, but also that the endpoints themselves become newly constrained in local compute. Regardless of exactly what happens to device form factors, core assumptions underlying the endpoint market will be eroded by agents. Vendors and buyers with adaptable plans and the capability to handle fragmented execution will come out ahead.

If you’re building in this space, we’d like to hear from you.

Feel free to reach out to jpark@forgepointcap.com and kshih@forgepointcap.com.

This blog is also published on Margin of Safety, Jimmy and Kathryn’s Substack, as they research the practical sides of security + AI so you don’t have to.

[1]https://www.philvenables.com/post/things-are-getting-wild-re-tool-everything-for-speed