Not by default, and model size has nothing to do with it. When an AI agent can open your files, click through applications and send messages as you, the risk depends on its permissions, not its parameter count. A trillion-parameter model is still vulnerable to cross-prompt injection: instructions hidden in a document, web page or email that hijack the agent. Microsoft names that risk in its own Windows documentation. Running the agent locally on an NVIDIA DGX Station GB300 keeps your data on your premises, but it does not make the agent trustworthy. What makes it trustworthy enough is a separate agent account, the narrowest file and app access that still does the job, human approval for consequential actions, and a log of everything it does. Windows and NVIDIA are building those controls, but the key pieces were still experimental or in preview on 4 Nov 2026.
What is NVIDIA actually proposing?
NVIDIA's 31 May 2026 announcement of DGX Station for Windows describes a deskside system that can run models of up to one trillion parameters and "hundreds of agents running simultaneously", connected to Windows apps. Each agent runs inside NVIDIA OpenShell, an open-source runtime that NVIDIA says creates "an individual, isolated sandbox for each agent". Its policies are enforced at the system level rather than through the prompt, so an agent cannot talk its way past them. Microsoft's developer blog (2 Jun 2026) says OpenShell on Windows is built on Microsoft Execution Containers, a new isolation SDK that was in early preview at the time. OEM Windows models are expected from Q4 2026, and we have not found one shipping yet.
The trillion-parameter claim is about memory, not judgement. At 4-bit precision, a one-trillion-parameter model needs roughly 500GB for its weights. That fits inside the DGX Station's 748GB of coherent memory, which is why NVIDIA can make the claim. It says nothing about whether the agent will follow your rules when a document tells it not to.
What can go wrong, and what controls exist?
| Risk | What it looks like | Control available (status) |
|---|---|---|
| Cross-prompt injection (XPIA) | A supplier PDF or web page contains hidden text telling the agent to email files out | Windows: MCP servers contained by default; Defender prompt-injection protection announced; CSA Addendum control 4.1 input guardrails |
| Excessive agency | Agent has rights to send, delete or pay when it only needed to read | Separate agent account with least privilege (Windows agent workspace, experimental); OWASP LLM06 mitigations |
| Over-broad file access | Agent reads HR or finance folders it never needed | Per-agent folder permissions: "Allow Always / Ask every time / Never allow" (Windows, experimental) |
| Unreviewed actions | Agent sends a customer email or approves an order on its own | Human confirmation for consequential actions (Microsoft, OpenAI and Anthropic guidance; IMDA agentic framework) |
| No audit trail | Nobody can reconstruct what the agent did | Tamper-evident activity log (Windows design goal); central SIEM logging (CSA Addendum 4.3) |
| Agent escapes its box | Agent code or tools reach the wider system | OpenShell sandbox per agent on Microsoft Execution Containers (early preview) |
Sources: Microsoft Support "Experimental agentic features" (updated 5 Dec 2025), Windows Experience blog (16 Oct 2025), Windows developer blog (2 Jun 2026), Microsoft Learn MCP on Windows (4 Jun 2026), NVIDIA newsroom (31 May 2026), OWASP Top 10 for LLM Applications 2025 (LLM06), CSA "Securing Agentic AI" Addendum v1.0 (17 Jun 2026), IMDA Model AI Governance Framework for Agentic AI (22 Jan 2026). Statuses as published by the vendors.
How does Windows limit what an agent can touch?
Microsoft's design gives each agent its own Windows account and its own workspace, running in a separate session from the signed-in user. The feature is off by default and only an administrator can switch it on for the whole device. Agents must ask for access to known folders such as Documents, Desktop and Downloads, and the user chooses per agent whether to allow always, ask every time or never allow. Microsoft also says agents should be signed so they can be revoked, should run with least privilege, and should have their actions logged. MCP servers, the connectors that let agents use apps and data, run contained by default and can be controlled per agent through Settings or Intune.
These are good foundations. But Microsoft labels the agent workspace experimental, and the execution-container SDK under OpenShell was in early preview in June 2026. In Microsoft's own words, malicious content in documents or interface elements can override agent instructions, "leading to data exfiltration or malware installation". Microsoft's documentation tells you the risk is real.
A bigger model is a more capable agent, not a more obedient one. Trust comes from what the agent is allowed to do, who approves it, and whether you can see what it did.
Does running the agent locally help?
Yes, for one specific risk: your documents and prompts are not sent to a cloud provider, which simplifies PDPA questions about overseas transfers and data retention. It does not help with prompt injection, excessive permissions or mistakes, because those happen on the machine, whoever owns it. A powerful local agent with broad rights can do more damage faster than a slow cloud one. For where company data goes when staff use cloud AI, see Your Company Data Is Feeding AI.
What rules should you set before switching agents on?
- Use a dedicated agent account, never an admin. CSA's Addendum says agent roles get no admin or sudo rights by default. Microsoft, OpenAI and Anthropic all recommend low-privilege accounts or dedicated machines for computer-use agents.
- Grant folders and apps one at a time. Start with "Ask every time" and widen access only for tasks that have proven reliable.
- Require a human click for anything outward-facing or irreversible. That covers sending email, deleting files, posting, paying and changing permissions. IMDA's agentic framework keeps humans accountable through approval checkpoints.
- Allow-list outbound destinations so an injected instruction cannot send data to an unknown address (CSA Addendum controls 2.6 and 2.7).
- Log every agent action centrally and review the logs, as CSA's control 4.3 recommends.
- Pilot on non-sensitive data first. Treat early Windows agent features as previews until Microsoft and NVIDIA declare them production-ready.
For how these rules apply to everyday Office automation, read What Happens When Your AI Agent Can Control Excel, Outlook and Your Entire Desktop?. For whether the station should be online at all, see Should Your Company's Most Powerful Computer Be Connected to the Internet?. Our earlier pieces Your AI Assistant Might Be Your Biggest Security Risk and Would You Trust an AI Agent With Your Company's Credit Card? cover the wider risk picture.
Buying in Singapore
If you are planning a local agent platform, SourceIT lists all five DGX Station GB300 models, each price on request: the HP ZGX Fury G1n, MSI XpertStation WS300, ASUS ExpertCenter Pro ET900N G3, GIGABYTE W775-V10-L01 and Supermicro ARS-511GD-NB-LCC. Tell us whether you need Windows, and we will confirm each OEM's Windows SKU and timing. Browse the NVIDIA DGX Spark and DGX Station collection. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Is a bigger AI model safer to give desktop access to? No. Model size affects capability, not resistance to manipulation. Microsoft names cross-prompt injection as a risk for agents on Windows regardless of the model behind them.
Are Windows agent features ready for production? Not fully. Microsoft labels the agent workspace experimental and off by default, and the execution-container SDK that NVIDIA OpenShell builds on was in early preview in June 2026.
What is NVIDIA OpenShell? An open-source runtime for autonomous agents. NVIDIA says it gives each agent its own isolated sandbox, with policies enforced by the system rather than by the prompt.
Does a local agent remove PDPA concerns? It removes the overseas-transfer question for data the agent processes locally. You still need reasonable security arrangements, retention limits and access controls under the PDPA.
What is the single most important control? Least privilege: a dedicated agent account with only the folders and apps the task needs, plus human approval before anything is sent, deleted or paid.
