Nvidia released new open models on October 19 aimed at running agents inside enterprises and on personal computers, and on the same day Microsoft argued that deployed agents should be treated like insider threats because frontier models cannot be fully trusted. Read together, the two announcements describe a market where agent capability is becoming commoditised while agent accountability is becoming the differentiator. That combination changes how buyers evaluate vendors, and it changes what evidence a vendor needs to publish before a procurement decision can be defended.
Key Conclusions
The first conclusion is that open weights shift the burden of proof from capability to control. When any buyer can run a capable model locally, the question stops being whether the model is good and starts being whether the vendor can show what the agent does, what it can reach and how it is constrained. Vendors that answer those questions with documentation rather than assurances will win the procurement conversation.
The second conclusion is that the insider-threat framing is a buying criterion, not just a security posture. If an agent is treated as a potential insider, then audit trails, permission scoping and rollback capability become part of the product specification. Buyers evaluating vendors should expect those three items to be demonstrable, not promised.
What the Two Announcements Add Up To
Nvidia is pushing capability down the stack by releasing open models for enterprise and desktop agents, which lowers the cost of entry and makes differentiation harder at the model layer. Microsoft is pushing accountability up the stack by arguing that agents cannot be fully trusted, which raises the value of the controls around the model. The two moves are complementary, and together they compress margin in capability while expanding it in governance.
Why Local Execution Matters for Evidence
When an agent runs locally, the vendor cannot rely on telemetry from a hosted service to prove behaviour. That makes documented behaviour more important, not less, because the buyer has to verify claims with their own logs. Vendors that ship structured logs and clear permission manifests make that verification cheap, and cheap verification is what turns a pilot into a purchase.
The Insider-Threat Analogy in Practice
Treating an agent as an insider means applying the controls you would apply to a new employee: least privilege, activity logging, periodic review and an exit procedure. The analogy is useful because it forces specificity. An agent that can read a customer database but not write to it is a different risk profile from one with write access, and the difference should be visible in the specification.
Best Practices
For buyers, the practical approach is to request four artefacts during evaluation: a permission manifest, a sample audit log, a rollback procedure and a documented failure mode list. Vendors that can produce all four in a week are usually the ones with real deployments. Vendors that produce slideware are usually the ones that have not yet run an agent in a production environment.
Score Vendors on Verifiability
A simple scoring model works better than a feature matrix: for each claimed capability, ask whether the buyer can verify it independently, and at what cost. Capabilities that can be verified from logs score higher than capabilities that require trusting a dashboard. This reframing tends to favour smaller vendors with transparent engineering over larger ones with polished marketing.
Publish Evidence Before It Is Requested
For vendors, publishing evidence before it is requested shortens procurement cycles. A public page documenting permission scopes, logging format and rollback behaviour answers the first three questions a security reviewer will ask, and it signals that the product has been through a real deployment. The cost is a few days of writing; the benefit is being shortlisted without a security questionnaire round.
Common Mistakes
The first mistake is comparing vendors on benchmark scores when the benchmarks do not measure the behaviour the buyer cares about. The second is accepting a security questionnaire as evidence, when a questionnaire records claims rather than tests them. The third is treating open weights as automatically safer, when local execution removes the vendor telemetry that would otherwise reveal misuse.
A fourth mistake is scoping pilots to the easiest use case, which produces a clean result and no information about failure modes. Pilots that include at least one adversarial scenario, such as an agent asked to act outside its permission scope, reveal far more about the control environment than a successful demo.
What Changes in Procurement
Procurement teams are starting to ask for agent specifications in the same format they use for third-party software: data access, retention, logging, subprocessors and termination. That format was built for SaaS and it transfers reasonably well to agents, with one addition: the agent needs a defined action space, because the risk is not only what data it sees but what it can do.
The practical consequence is that agent vendors will increasingly be evaluated on documentation quality. That is an unusual shift for an AI market that has competed on capability, and it favours vendors that treat governance as a product feature rather than a compliance afterthought. Buyers should expect the best proposals to arrive with an evidence pack rather than a demo link.
Summary
Nvidia open models and Microsoft insider-threat framing point in the same direction: capability is commoditising while accountability is becoming the differentiator. Buyers should score vendors on verifiability, and vendors should publish evidence before it is requested.The practical consequence is that planning cycles shorten and the cost of being wrong rises.That distinction matters because it changes which team owns the decision.
The four artefacts to request are a permission manifest, a sample audit log, a rollback procedure and a documented failure mode list. Procurement should add a defined action space to the standard software review, because an agent risk is as much about what it can do as what it can see.Teams that document the assumption can revisit it later without rebuilding the whole model.
Data Sources
Nvidia launches new open models to run agents in the enterprise and on PCs
Microsoft says AI agents are like insider threats as frontier models cant be trusted
Amazon takes its biggest shot at Nvidia yet with new TorchNeuron dev tool
FAQ
Why do open models change vendor evaluation?
A: When any buyer can run a capable model, capability stops being the differentiator and verifiable control becomes the buying criterion.The same logic applies to any category where the input cost moves before the shelf price does.Buyers should ask for the number behind the claim rather than the claim itself.
What does treating agents as insider threats imply?
A: Least privilege, activity logging, periodic review and an exit procedure, all of which become part of the product specification.The practical consequence is that planning cycles shorten and the cost of being wrong rises.That distinction matters because it changes which team owns the decision.
Which artefacts should buyers request?
A: A permission manifest, a sample audit log, a rollback procedure and a documented failure mode list.Teams that document the assumption can revisit it later without rebuilding the whole model.The same logic applies to any category where the input cost moves before the shelf price does.
Why does local execution increase evidence needs?
A: Vendor telemetry from a hosted service is unavailable, so the buyer must verify behaviour from their own logs.Buyers should ask for the number behind the claim rather than the claim itself.The practical consequence is that planning cycles shorten and the cost of being wrong rises.
What should be added to a standard software review?
A: A defined action space, because agent risk depends on what it can do as well as what data it can see.That distinction matters because it changes which team owns the decision.Teams that document the assumption can revisit it later without rebuilding the whole model.
Why are adversarial pilot scenarios useful?
A: They reveal how the control environment behaves when an agent is asked to act outside its permission scope.The same logic applies to any category where the input cost moves before the shelf price does.Buyers should ask for the number behind the claim rather than the claim itself.
References
Nvidia launches new open models to run agents in the enterprise and on PCs
Microsoft says AI agents are like insider threats as frontier models cant be trusted
Amazon takes its biggest shot at Nvidia yet with new TorchNeuron dev tool
