Perplexity today introduced hybrid compute for its agentic platform Computer, a system that lets a single AI agent split work between frontier models running in the cloud and smaller open-weight models running locally on Apple silicon Macs. The aim is to route sensitive information to the user’s device so it never leaves the machine.
The company says this is the first time an AI agent can start a task in the cloud and dynamically hand off the confidential portions of that same task to a model running on the user’s hardware without restarting the job or losing context. The feature is available immediately through Perplexity’s desktop app for enterprise customers who opt in, and for Pro and Max subscribers on any Apple silicon Mac running macOS 15 or later.
Jon Staff, who leads Perplexity’s macOS and iOS engineering teams, told reporters that hybrid is compelling because confidentiality often coincides with the need for highest accuracy. “By combining these two together, we can get that maximum intelligence from the frontier models, but we also get the security and the privacy that comes with local,” he said.
Privacy Gate and orchestration: how sensitive data stays local
The architecture acts like a dispatcher. A frontier model in the cloud breaks a task into subtasks and routes each one to the appropriate place. Web research, long-horizon planning and heavy reasoning run in the cloud, while anything touching private files, local data or device actions gets delegated to a subagent running on the Mac itself.
Central to the design is a component Perplexity calls the Privacy Gate: a company-trained classifier that runs on the device and scans for personally identifiable information (PII) — names, addresses, account numbers, secrets — before anything is transmitted to the cloud. When the gate flags sensitive content, the user chooses whether that portion of the task runs locally or is shared.
Staff described the handoff: cloud orchestration breaks down the task based on the prompt, determines routing to subagents, delegates the private piece to the Mac subagent, and that portion runs entirely locally — none of those tokens go to the cloud.
Economics matter: Perplexity meters cloud usage with credits, and tokens generated locally incur no credit charges. “You’re paying for the electricity, you’re paying for the hardware, so we’re not charging you for that,” Staff said. Credits are used only for orchestration and delegation.
Demonstrations targeted at privacy-sensitive professional work
Perplexity built demos around workflows professionals would rarely send to a cloud-only agent. In one, a lawyer under deadline updated a draft brief against privileged case files stored on a Mac while a cloud agent simultaneously pulled public case law from the web — Perplexity says only anonymized legal questions were sent to the cloud. “At no point did their privileged information get shared to the cloud,” Staff said.
In another demo, a private equity associate’s agent reworked a financial model against confidential management projections, benchmarked the deal against public comparables, and produced a fifth iteration of an investment committee deck. The task ran roughly 40 minutes in the background with no human input — work that otherwise would have required hours of manual stitching between local spreadsheets and cloud research.
A third demo emphasized continuity across devices: the founder of a pottery shop, riding in an Uber, kicked off a marketing analysis from her iPhone. Computer requested permission to reach her Mac at the studio, fired up the local subagent to process customer interviews and revenue data, and combined that with cloud research on competitors’ public pricing. “It doesn’t matter how far away she is from her computer,” Staff said.
Staff argued these tasks aren’t possible in a fully local or fully cloud setup: you need local security and privacy and the intelligence of frontier models.
Model choices, geopolitics and sandboxing
At launch, users can choose among three local models: Google’s Gemma E4B, Alibaba’s Qwen3.6 35B-A3B, and a Perplexity post-trained version of Qwen3.6 35B, which Perplexity recommends. The inclusion of Chinese-developed Qwen models prompted questions about whether enterprise or government customers were uncomfortable with those models having access to machines.
Staff said local inference reduces geopolitical risk: because the models are open-weight and run locally, data and tokens do not leave the user’s computer or get sent to a cloud provider hosted in another country. He added that Perplexity’s models themselves are U.S.-hosted.
Staff also pointed to macOS’s built-in sandboxing framework, Seatbelt, which constrains what the agent can do on a machine: if local execution tries to perform disallowed actions, it will be blocked and request permission from the user. Perplexity currently does not permit an unrestricted “YOLO mode,” though Staff said he wouldn’t be surprised if certain users are allowed that option in the future.
For enterprises, admins can set a single organization-wide sensitivity policy and audit a full record of what leaves each device — a feature aimed at compliance teams in law, finance and healthcare. On the consumer side, questions remain about how usage data feeds model training. Staff pointed to Perplexity’s incognito mode and a longstanding opt‑out toggle, and said enterprise contracts can include zero-data-retention terms. A company spokesperson said Perplexity is “not using it for post training” globally and promised follow-up details for non-enterprise accounts.
Industry context, growth and limits
The announcement arrives amid broader industry concerns: NIST’s generative AI risk profile highlights data privacy and information leakage as central risks, and McKinsey’s research finds data governance a major barrier to turning AI experiments into value. Gartner named hybrid computing among top strategic technology trends for 2025, expecting architectures that blend compute across environments.
Perplexity’s bet is that the solution isn’t choosing between cloud intelligence and local privacy but building an orchestration layer that arbitrates between them in real time. The company has positioned itself as a neutral application-layer broker that can integrate whichever models lead at a given moment.
The product rollout has been rapid. Perplexity launched the Comet AI browser in July 2025, initially for $200-a-month Max subscribers; Computer arrived in March 2026, followed by Mac and Windows desktop apps. Last week the company launched a local-first Computer on NVIDIA’s DGX Spark hardware; that version starts on-device and escalates to cloud models only with permission. Today’s release inverts that flow by starting cloud-first and delegating down.
Perplexity’s business trajectory has also been steep: valued at $520 million in January 2024, the company reached a $20 billion valuation by a funding round finalized in September 2025. Along the way the company made a $34.5 billion bid for Google’s Chrome browser during Google’s antitrust remedies process, and Bloomberg reported Apple executives held internal talks about acquiring Perplexity — a notable backdrop for a product designed to showcase Apple silicon.
The approach faces headwinds. Reuters reported in July that Reddit’s data‑scraping lawsuit against Perplexity survived a motion to dismiss, part of broader copyright and data litigation facing the company. Perplexity recommends at least 32 GB of unified memory for the higher tier of local models and Staff acknowledged the smallest option “significantly underperforms” the larger Qwen models. Windows and Linux support will come later.
A deeper limit is intrinsic: the Privacy Gate is itself a machine learning classifier and classifiers miss things. A false negative could let sensitive data reach the cloud. Perplexity’s counter is transparency: users can expand and review exactly what the gate flagged before anything is sent, and enterprises receive device-level audit logs. Ultimately, Perplexity asks professionals to trust one AI to decide what another AI can see — pitching a smarter gate rather than a higher wall as the fix for enterprise privacy concerns.
