Browser AI, desktop agents and coding agents: three different risks

What is the risk with AI in the browser?

When someone uses an AI chat tool in a browser tab, the main risk is what they give it. A customer list pasted into a prompt, a contract uploaded for a summary, or source code shared to find a bug all leave the company the moment the request is sent. The tool itself does nothing on the laptop. It reads what it is given and sends text back.

That makes browser AI a data problem. The controls that fit sit where the data leaves: a browser extension that sees the text before it is sent, or a network or SSE proxy that sees the request on its way out. Both can block, and the better ones can warn the person or mask the sensitive part.

What changes with desktop AI agents?

A desktop AI agent is installed on the computer and can act on it. Depending on its permissions, it can open and edit files, use other applications and connect to outside tools. The data risk is still there, but now there is a second risk: the agent may do something on the device that nobody asked for, because it misread a request or because content it read told it to.

That second risk is invisible to a browser extension, and often to a proxy, because the action never leaves the laptop. Only a control on the device, or settings inside the agent, can see it.

Why are coding agents the hardest case?

Coding agents such as Claude Code, Codex and Cursor are built to act. They read and write code, run shell commands, install packages, and connect to MCP servers that give them more tools. A developer can add an MCP server with one line in a configuration file. Many of those servers run on the same laptop and talk to the agent through standard input and output, so their traffic never crosses the network at all.

Developers also tend to hold the most powerful access in a company: source code, cloud credentials, production systems. An agent running with that access, and with tools nobody reviewed, is the case the OWASP GenAI Security Project describes as excessive agency, which it ranks third in its 2026 Top 10 for LLM Applications.

How does the answer change the control you need?

• Only browser AI: start with a browser extension or your proxy, and a policy on what data may go into which tools.
• Desktop agents: add an on-device control, or at least the agent's own administrator settings.
• Coding agents with MCP servers: an on-device control that can decide on individual tool calls is the position that sees the most. A gateway helps for remote MCP servers.
• Not sure: find out first. A survey, your device management inventory and your EDR may already show which AI tools are installed.

The finder adds points to each control type from this answer, and it weighs coding agents most heavily toward the device. Run the finder with your mix to see where it lands.

Sources