Neuvottelija.com

2026-07-15 · AI Lab · Insight

Local Models and AI Sovereignty: Why Owning Your Stack Is Becoming a Strategic Question

I keep coming back to a strange fact about my own year: the machine that has done the most to change how I work is not a subscription. It is a Mac Mini humming on my desk, and a MacBook Pro with a partition on it where an agent I call Hermes lives. Nobody can suspend that account. Nobody at a trust-and-safety desk in California can decide, on a slow Tuesday, that my access to my own reasoning engine should be paused pending review. That distinction — between renting intelligence and owning it — is the thread running through two conversations I want to pull together here: Onko tekoäly pelkkää kuplaa? with Petri Kajander, and Tekoälykoodaus huipputasolla with Markus Hav.

The hardware is no longer the bottleneck

Petri opened our conversation by needling me, as he always does, but the needling carried real information. He runs the Chinese Qwen 3.6 model directly on his own Mac hardware — no cloud call, no API key, no account to ban. On my side, the setup has grown into something more elaborate: a 64-gig MacBook Pro as the main machine, and a Mac Mini with 16 gigs of memory that I bought the week before Peter Steinberger released OpenClaw. Petri put it plainly: “since Sami is now Head of AI, you’re the sovereign operator who wants to partition machines like a god” (03:31). On the main machine there is a partition where Hermes lives, running Gemma and Qwen locally on unified memory, entirely on-device.

That word — unified memory — is not decoration. Petri pointed out that Apple’s M-series architecture “probably stumbled into unified memory purely by luck,” a design choice from years before anyone cared about running large models at home, that happens to make consumer hardware capable of hosting real local inference today. The practical upshot is that the question “can I run a serious model without asking anyone’s permission” now has a “yes” answer that fits on a desk.

Markus Hav’s episode, recorded five months earlier, shows the same instinct from the coding side. He described buying a Mac Mini specifically to run what he still calls “Open Cla—” (he never quite lands on the name), and immediately, unprompted, named the tradeoff: he wouldn’t want to be a first mover on the security risks of an agent with broad account access. He described giving his own agent, which he named Samantha, a staged, caged onboarding — a fake Gmail, a Telegram channel as the only line of communication, dropped first into an Azure sandbox rather than anywhere near his real accounts, so that “if she escapes from there, then she’s earned her freedom.” The joke does real work: it is a mental model for how much trust and access an agent should be handed, and it inverts the usual security assumption. As Hav put it, “the whole idea of AI is that the more data you give it, and the more agency you give it, the more it’s able to do. But traditionally, security never, ever works that way — instead you know what you want and you scope your task to exactly that much” (06:12).

When the platform, not the model, is the risk

The reason local models matter is not really about model quality anymore — it is about what happens to the account layer sitting on top of cloud models. Petri’s account ban story is the clearest illustration in either conversation. He posted a video for his app, Läppä, on Threads. The only thing unusual about it, in his telling, was that the word “no” appeared somewhere because it related to a product feature. Nothing else. “The moment I’d posted it, the message came back that the account is currently, like, shelved. Then you can go ahead right away and file an appeal, and that was basically total nonsense, and after that it was just done” (20:22). He was not alone — he noted that Paul Graham, the founder of Y Combinator, had the same thing happen to him a few weeks later on the same family of platforms. Petri’s conclusion was not paranoid, just tired: “You don’t have anyone you can go and ask to fix it. You need to know someone on the Meta team.” He added, almost as an aside, that for his own YouTube channel he has a personal safety net most people don’t: “luckily I do have friends at Alphabet, so I’d be able to escalate that” (21:30) — which is itself the point. If avoiding platform risk depends on who you happen to know, that is not a system, it is luck.

He recounted a second, more serious case secondhand: a user with a long history on Google Workspace and Drive who had uploaded personal manga illustrations to their own private, unpublished Drive folder. According to Petri’s account, an AI system interpreted one of the images and the entire account — Drive, YouTube, everything tied to it — was taken down at once. He linked this directly to the current EU push, noting that European Commissioner Henna Virkkunen and colleagues have brought CSAM scanning back into AI regulation discussions, and predicted more automated enforcement of this kind is coming.

This is not confined to consumer social accounts. Petri described token-based AI subscriptions getting yanked without warning too, once Anthropic shifted from a queue-based model to a token economy: two separate $50 top-ups burned through in a single morning before lunch, after which he removed Anthropic from his API keys entirely and moved to open-source models. He described the same pattern hitting GitHub Copilot and Google’s Antigravity tool, including companies of 30 to 50 people running on a single Claude seat that lost access outright when usage patterns triggered anti-abuse heuristics — same browser, same machine, same location, same typing cadence. Whether the ban is content moderation or billing fraud detection, the mechanism is identical: an account-holder has no recourse, no named point of contact, and no way to appeal a decision made by an automated system.

The regulatory layer is compounding it

Petri connected the platform-risk story to a regulatory one that predates AI entirely but is now colliding with it. His encryption app, Nootti, is banned in France — not because of content, but because standard public-key encryption in an app requires prior clearance from a French communications ministry, a rule he compared to “sending a fax.” He tied this to a broader worry: “we’re heading toward a point where soon you won’t be able to go anywhere and read Iltasanomat unless you’ve put your passport up somewhere for verification,” framed as protection for children but functioning, in his account, as a shrinking of the open internet built in the 1990s.

He also raised the danger of the reversed burden of proof once identity theft happens through an AI-enabled hack: “you have to prove what you didn’t do, which is pretty much impossible since you don’t necessarily know what’s been done in your name” (23:50). Finland’s personal ID number, he noted, is effectively irreplaceable once leaked — unlike the newer renewable identity numbers now becoming available.

Owning the memory, not just the model

Hav’s episode adds the piece Kajander’s doesn’t dwell on: what you actually build once you control the stack. He described the difference between a stateless chatbot and an agent with persistent memory as fundamental, not cosmetic: “every single conversation changes the agent itself… every moment you talk with it, it’s a different agent, which, in a way, in a very fundamental way, changes where the agent’s place is in that conversation” (10:20). That persistence is exactly what you want under your own control rather than a vendor’s — it is accumulated, curated context about how you work, and losing access to the account means losing access to that accumulated memory too.

He also pushed back gently on his own AI enthusiasm from a security seat: since his day job is at a security company, he said, he is extremely aware of prompt injection risk, and that is exactly why he personally does not run any agentic browsers at all. That is a professional in the field choosing not to grant an agent that particular form of access — a useful counterweight to the instinct to give agents more reach simply because they can be given it.

Where I land

Running local models on my own Mac hardware, with Hermes on a partitioned machine, is not a hobbyist affectation — it is the direct response to watching Petri’s Threads account get shelved over one word with no appeal path, and to watching whole companies lose Claude seats overnight because a heuristic flagged their typing pattern. Petri said it best: don’t ever send me anything confidential, because what’s curated and kept on my own machine, physically, here, is the only part of this stack nobody else can suspend. I don’t think the answer is to reject the big cloud models — I use them daily, and Hav is right that the persistent, learned context an agent builds up is genuinely valuable. But the account layer sitting on top of that intelligence is rented, and rented things get repossessed. The France encryption rule and the EU’s CSAM-driven scanning push are the regulatory version of the same risk: control that looks like it belongs to you can be withdrawn by someone else’s policy decision. That’s the strategic question now, for individuals and firms alike — not whether AI works, but who holds the off switch for the copy you depend on.

Source episodes

Every claim in this essay is grounded in the following episodes; quotes carry timestamps linking to the original video. English subtitles and full transcripts are on each episode page.

← AI Lab · Markdown mirror: index.md