Apple says the new Mac Studio takes up to 128GB of unified memory with M5 Max and up to 512GB with M5 Ultra, enough to “run enormous LLMs entirely on device”. Several can be clustered over Thunderbolt 5 into one shared memory pool for large open-weight models. Apple names LM Studio, MLX and on-device coding agents in Xcode among the uses. That makes a Mac Studio a plausible AI server for a team, a lab or one developer.
On-device means your prompts do not go to a cloud provider. It does not mean nothing can go wrong on the device. A Mac Studio running models and agents has an attack surface of its own.
What changes when a Mac Studio runs AI
- Model files from public hubs. Weights arrive from Hugging Face, Ollama’s library or a link in a chat. Pickle-based formats can run code when they are loaded, and a GGUF file carries a chat template that can hold instructions aimed at the model.
- A local inference server. Ollama and LM Studio expose an HTTP API. Whatever can reach the port can use the models, so the bind address decides who that is: this Mac, the office LAN, or every node in a cluster.
- Agents with a shell. A coding agent runs commands, reads files and edits code with the rights of the account it runs in.
- MCP servers. Model Context Protocol (MCP) servers give agents tools. Their tool descriptions and results go straight into the model’s context.
- Data moving between them. A local model that reads a poisoned file or web page can still be prompt-injected. A secret pasted into a prompt still sits in a transcript, even if it never leaves the room.
A hardening checklist
All of these are built into macOS or the model servers. Paths are from Apple’s current macOS User Guide.
1. Turn on FileVault
Apple says that on Apple silicon “your data is encrypted automatically”. FileVault adds a login password requirement before the disk can be read. Turn it on in System Settings > Privacy & Security > FileVault, and keep the recovery key somewhere other than the Mac.
2. Turn on the firewall
System Settings > Network > Firewall. Under Options, “Block all incoming connections” suits a box that only serves itself. Stealth mode stops the Mac answering probes such as ping. If the model server must take connections, allow that one app and nothing else.
3. Keep the inference server on loopback
Both servers listen on loopback by default. The Ollama FAQ says it “binds 127.0.0.1 port 11434 by default”, and the OLLAMA_HOST variable changes that. LM Studio’s lms server start binds 127.0.0.1 by default, and --bind 0.0.0.0 opens it to the network. Leave both on loopback unless other machines need them. If they do, LM Studio recommends authentication for any other bind: turn on its API token requirement, and let the firewall decide who reaches the port.
4. Give agents their own standard account
Run coding agents and model servers in a standard user account, not your administrator account. A standard user cannot add users or change other users’ settings, and your own files and credentials stay in a different home folder.
5. Stay current
In System Settings > General > Software Update, turn on Automatic Updates, including “Install Security Responses and system files”. Update Ollama, LM Studio and your agents on the same schedule.
6. Prefer formats that cannot run code
Pull models from publishers you trust, and prefer SafeTensors or GGUF over pickle-based files. Turn off sharing services you do not use in System Settings > General > Sharing.
Where MoorAI fits
MoorAI checks what AI agents and models do, on the device, before each action runs. Each row below is shipped in agent v1.25.0.
| Risk | What MoorAI does |
|---|---|
| A malicious model file | moorai-model-scan reads pickle and PyTorch, Keras, TensorFlow SavedModel, ONNX, GGUF (Ollama’s blobs included) and SafeTensors files without loading them, and gives each a verdict. On an enrolled Mac, downloads an agent runs, such as ollama pull or hf download, are scanned once they finish. A signed policy can add a daily scan of the Ollama, LM Studio and Hugging Face model stores. |
| An inference server others can reach | The AIBOM lists running local model servers, including Ollama, LM Studio, llama.cpp and vLLM, with each port and whether it listens beyond loopback. A server that can be reached without going through MoorAI raises a LOCAL_MODEL_EXPOSED alert, and moorai-doctor shows it on the Mac. |
| An agent with a shell | The pre-tool hook checks every command, file read and tool call before it runs: in Claude Code, where enforcement is validated end to end, and in Codex, Copilot CLI, Gemini CLI, Cursor and Factory Droid through adapters. The desktop app can launch an agent in an experimental Seatbelt profile that denies writes to system and application folders. |
| MCP servers | The MCP guard sits between the host and each local MCP server, and the MCP gateway in front of remote ones. Both check every tool call and result, and can block a tool whose description changed since it was approved. |
| Data between agent and model | The model proxy listens on 127.0.0.1 with a route to Ollama, and any OpenAI-compatible local server, such as LM Studio, llama.cpp or vLLM, can be added as a route. It scans what the agent sends for secrets, personal data and injected instructions, and decides each tool call the model returns. Egress rules decide which program may reach which host. |
| Models with safety training removed | The AIBOM counts local models whose names say their safety training was removed, such as “abliterated” or “uncensored”, without reporting the names. |
Every check runs on the Mac. The console receives a category, a risk level and a keyed one-way hash, never the prompt, file or model name.
Which MoorAI product
MoorAI for Agents
The free, open-source (MIT) endpoint agent for macOS and Windows. Install it on the Mac Studio for the hook, the model scan, the AIBOM and the model proxy. Learn more
MoorAI Management Server
Turns several Macs into a governed fleet with signed policy and content-free alerts. Free to self-host with no user limit; hosted at app.moorai.dev as a free trial, then contact us. Learn more
MoorAI for AI Servers
If the Mac Studio runs agent services or a retrieval pipeline for other people: a sidecar with the model proxy, the MCP gateway, the Agent SDK integration and scan-before-embed for vector stores. Priced per server; contact us. Learn more
Sources
- Apple. Apple introduces new Mac Studio with M5 Max and M5 Ultra (figures are Apple’s); macOS User Guide: FileVault, firewall, firewall settings, other users, macOS updates.
- Model servers. Ollama FAQ; LM Studio
lms server startand server settings. - MoorAI. Agent v1.25.0 on GitHub: the README and
cli/model-scan.mjs,cli/local-ai-inventory.mjsandcli/local-model-exposure.mjs.
See also: MoorAI for AI coding agents and Backdoored models show up in what they do.
Mac Studio is a trademark of Apple Inc. MoorAI is not affiliated with Apple.