Your Employees’ AI Agents Are Already Inside Your Data

The agent on your employee’s phone is the new insider

Personal AI agents have quietly become the biggest hole in enterprise security, and most security stacks can’t see it. That’s the core argument from my conversation with Dustin Allen, co-founder of Trinitite, on this episode of What Breaks Next.

Trinitite describes itself as the control layer for the personal agent era: the way to make AI follow your rules. It’s a local AI model that runs on your phone or desktop and sits between your agents and your data. Agents can’t help themselves to whatever they want. They have to ask, and the guardian learns your rules over time so you aren’t answering a hundred permission prompts an hour.

Why MDM, DLP and endpoint security miss it

The trouble is that the risky moment happens inside a conversation, and conversations have always been off-limits to monitoring. Mobile device management, data loss prevention and endpoint tools were never allowed to read private messages. That boundary made sense for people. It makes far less sense for agents.

Picture the exchange. An employee asks an agent to handle a task. The agent replies that it just needs access to Slack or Salesforce, and asks them to log in through a link. One tap later, the agent holds long-lived access to everything that account can reach. No MDM in the world blocks that, because the endpoint stack already granted the employee access to Slack and Salesforce in the first place.

BYOD makes it worse. Much of a company’s data now lives on devices people own and use at home. As Dustin put it, if your data can simply be accessed that way, it isn’t really the company’s data anymore.

You only need 10 to 20 percent of employees

Nobody is acting in bad faith here. When an agent asks for email access “just so I can summarize this for you,” it sounds harmless, and the employee is only trying to be productive. Agents are simply very good at asking for exactly what they need.

Scale changes the picture. Across a thousand employees, Dustin argues that if 10 to 20 percent connect personal agents, most of the company’s calendars, email and chat history has effectively left the building. That sounds high until you trace the overlap:

Email: every thread copies three or four more colleagues.

Calendars: one meeting invite exposes 30 attendees, and shared calendar access reveals other people’s schedules.

Slack: a single member of #general and #devops sees conversations across teams.

Coverage doesn’t require a whole division. One engineer, one marketer and one HR person are enough. And this is a two-sided problem: security teams now have to distrust the agent as well as the human.

The NDA breach nobody noticed

One Trinitite client shared a screenshot that makes the risk concrete. An employee connected Meta’s Muse assistant to their work accounts to help prep for the next day. Two or three sentences into the conversation, the assistant started discussing a prospect from the employee’s calendar.

That prospect was under NDA. The company couldn’t talk about the relationship at all, yet a third-party AI provider now had the details. The employee broke an NDA without realizing it. They were trying to be a good employee, and that good intent put the company in a legal bind.

A guardian agent that lives on the device

Trinitite’s answer is an independent verification layer: an extra set of eyes between agents and data. The guardian is a model that runs locally on the device and trains on the user’s own decisions, so it can enforce their rules without constant interruptions.

Dustin pointed to companies like Slack and Cloudflare, which solved one problem well at a single layer. The gap now is enforcement across every agent, not just at the server. Enterprises are building their own agents, but their employees are also bringing personal ones, and both need guarding.

The message differs by audience. To employees: this isn’t about adding friction, it’s about letting you do your job safely. To the CISO: don’t trust agents, don’t trust AI, and don’t trust ourselves either.

What breaks next: zero trust, applied to agents

Fifteen years ago, security teams learned to stop assuming the people inside the network were safe. Zero trust became the standard. The lesson from this conversation is that we now need the same shift for agents: zero trust, enforced on everything that can touch company data.

For CISOs and CIOs, three questions are worth asking this quarter:

How many employees have already connected personal agents to work email, calendars or Slack?

Which of those connections carry long-lived tokens no one is reviewing?

Where would you enforce a policy that applies to agents you didn’t build?

If those are hard to answer, that’s the part that breaks next.

What Breaks Next is Mesa Capital Partners’ research series on what enterprises will actually adopt, and what fails along the way. Watch the full conversation above, and get in touch to join the conversation.