Perplexity has reversed the direction of its agent platform. Computer, the company's agentic product, now starts a task in the cloud and hands the parts that touch private files to a model running on the user's own Mac, without losing the context built up so far. An on-device classifier inspects everything headed for the cloud, looking for names, addresses, account numbers and secrets, and stops to ask before any of it leaves. Jon Staff, who leads Perplexity's macOS and iOS engineering teams, casts the approach as combining the accuracy of frontier models with the safety of local processing. The company says this is the first time an AI agent has started work in the cloud and then passed the confidential portion of the same task to a model on the user's computer without losing context.
The architecture works like a dispatcher. A frontier model in the cloud breaks a request into subtasks and decides where each one runs. Web research, long-horizon planning and hard reasoning stay in the cloud. Work on personal files, local data and actions on the machine go to a sub-agent on the Mac. The sequence is fixed: request in the cloud, data check, local execution.
The check is performed by Privacy Protection, a classifier Perplexity trained and runs on the device itself. Before anything goes to the cloud it searches for personal data — names, addresses, account numbers, secrets. When it finds sensitive content, the user decides whether that piece runs locally or is sent out anyway. Staff said the cloud coordinator takes the task apart on demand and routes the separate pieces to different sub-agents; the confidential fragment runs entirely on the Mac, and its tokens are never sent to the cloud.
Local work also consumes no Perplexity credits. The user pays for electricity and for hardware they already own, and credits are charged only for coordination and for distributing the task. Perplexity presents this as a benefit to the customer, and it is one. It also means every token pushed onto a user's laptop is inference Perplexity does not have to buy — a point the announcement leaves for the reader to work out.
The three demonstrations Perplexity showed are all cases where a cloud agent would normally have to be kept away from the data. A lawyer updated a draft court filing against sealed case materials on a Mac while the cloud agent searched public rulings on the web; by Perplexity's account only anonymised legal questions went out, and privileged material never left the computer. A private equity employee reworked a financial model on confidential management forecasts, compared the deal against public comparables and produced a fifth version of an investment committee deck — roughly 40 minutes running in the background with no human involved, against several hours by hand. And the owner of a pottery studio began a marketing analysis from an iPhone in an Uber; Computer requested access to her Mac back at the studio, ran a local sub-agent over customer interviews and revenue data, then merged the result with cloud research on competitors' public pricing.
Distance to the machine does not matter, Staff said: the agent can reach the Mac remotely and carry on with local data. He also argued that none of these workflows can be done properly local-only or cloud-only — they need both the privacy of on-device processing and the capability of frontier models.
Three local models are available at launch: Google's Gemma E4B, Alibaba's Qwen3.6 35B-A3B, and Qwen3.6 35B in a version Perplexity fine-tuned itself, which the company recommends. Asked by VentureBeat whether enterprise and government customers would hesitate to give a Chinese model access to their computers, Staff said local inference lowers the geopolitical risk: the weights are open, so Perplexity can inspect them; running locally means no data goes to a foreign cloud provider; and all Perplexity models sit on servers in the United States.
A second boundary comes from macOS itself. The Seatbelt sandbox halts a local agent that attempts something it is not permitted to do and asks the user for approval. A fully unrestricted "YOLO" mode is not allowed, though Staff did not rule out some users getting one later.
For companies, administrators can set a single organisation-wide data sensitivity policy and pull a complete log of what information left each device. The feature is aimed first at compliance functions in law, finance and healthcare. For ordinary consumers the training question is less settled. Staff pointed to Perplexity's incognito mode and its long-standing opt-out toggle, and noted that enterprise contracts can include a full prohibition on data retention. A spokesperson said Perplexity globally "does not use this for fine-tuning", but promised to come back separately with the rules for non-enterprise accounts. That gap is the most telling thing in the announcement: the strongest guarantees are written into contracts that individual users do not sign.
The market context is real enough. NIST's generative AI risk profile lists information leakage and data privacy violations among the principal threats. McKinsey's State of AI work keeps finding that organisations struggle to move from pilots to returns, with data governance a leading obstacle. Gartner put hybrid computing on its list of strategic technology trends for 2025, forecasting the spread of architectures that span environments. Perplexity's bet is the coordination layer that decides, live, which side of that split each piece of work belongs on. It describes itself as a neutral intermediary across model providers — a spokesperson compared the company to Switzerland, because it works with everyone. Staff's version of the same argument is that improving any part of the stack, local models or frontier models or Apple's chips, improves Perplexity, which sits at the application layer and assembles the pieces.
The product line has expanded at speed. Comet, the browser with an AI agent, arrived in July 2025, first for Max subscribers at $200 a month. The full agentic platform, Computer, shipped in March 2026, followed by desktop apps for Mac and Windows. Last week Perplexity showed a local version of Computer for NVIDIA DGX Spark hardware, which starts on the device and reaches out to cloud models only with the user's permission. The new mode inverts that order. The finances moved just as fast: valued at $520 million in January 2024, Perplexity closed a round at a $20 billion valuation by September 2025, and along the way put a $34.5 billion offer on Google Chrome during the antitrust proceedings against Google. Bloomberg reported that Apple executives held internal discussions about buying Perplexity — which sits oddly alongside a product built specifically to exploit Apple's silicon.
Here is my reading of what Perplexity has actually built. The marketing is about a boundary, but the load-bearing component is a guess. Privacy Protection is a machine learning classifier, and classifiers are wrong sometimes; a false negative means confidential data goes to the cloud after all. Perplexity's answer is transparency rather than certainty — before sending, users can expand the flagged items and see exactly what the classifier caught, and enterprise customers get device-level logs. What that amounts to, for a lawyer or a healthcare compliance officer, is being asked to trust one AI's judgement about what a second AI is allowed to see. That is a different proposition from "your files stay on your machine", and the pitch does not spell out the difference.
The timing is not incidental either. In July, Reuters reported that Reddit's suit against Perplexity over data scraping had survived a motion to dismiss, one of a run of copyright and data disputes the company is fighting. A privacy-first architecture is commercially sensible for any AI company right now; for this one it is also reputational repair, and the two motives are impossible to separate from the outside.
The practical ceiling is lower than the demos suggest. Perplexity recommends at least 32 GB of unified memory for the larger local models, Staff concedes the smallest model is noticeably weaker than the bigger Qwen ones, and Windows and Linux support is still to come. So the population that gets the full version of this promise today is people with recent, well-specified Macs.
Perplexity's stated conclusion is that protecting work data calls not for a higher wall but a more accurate filter. Accept that and the privacy of every sealed case file, every management forecast, every customer interview now rests on the accuracy of a small model running quietly on a laptop — and on nobody ever needing to find out what its error rate is.