Perplexity moved the whole agent onto a Mac. Verify every path that stays local

01

WHAT ACTUALLY CHANGED

Perplexity brought three layers onto the same machine. The local model handles reasoning. The harness plans the task and calls tools. The execution environment performs code and file operations. Perplexity says all three can run on device, which is different from a desktop interface that quietly hands every difficult step to a remote service. That architecture can lower cloud-credit use, work offline and keep sensitive material closer to its owner. It also gives teams a practical way to run multi-step work over local documents without first uploading the whole folder to a hosted chatbot.

The product now makes Local and Hybrid two explicit compute paths. Local mode starts on the Mac. Hybrid mode coordinates cloud reasoning with local processing of private material. Perplexity says users can authorize cloud escalation from a local task when they need live web information, browser use, connected apps or a stronger remote model. That is a sensible design. Some work benefits from a small, private local model. Some work genuinely needs current information or more compute. The important part is whether the boundary is visible at the moment it is crossed, not buried in a settings page three weeks later.

The current rollout also clarifies practical limits. Fully local Computer requires a supported Apple silicon Mac, the current Perplexity app and an eligible subscription. Perplexity recommends 36 GB of unified memory. That word recommends is doing more work than requires, so buyers should test their actual task size, model choice, latency and thermal behavior before turning a hardware suggestion into a procurement standard. The November 6 notes mention a refreshed onboarding flow for choosing Local or Hybrid mode. Good onboarding should explain the consequences of that choice, including permissions, cloud escalation and what happens when a task cannot finish locally.

02

WHY THIS MATTERS

For people handling private files, a genuinely local agent can remove a major exposure path. A lawyer can review a folder of client documents. A financial analyst can compare private holdings with downloaded market data. A product team can summarize internal notes. If the model, harness and execution remain on the Mac, the raw material need not be copied into a general cloud inference system. That is valuable, but only if the surrounding apps do not re-export the same information. A document opened locally in a synced folder may already exist elsewhere. A draft placed in a cloud-backed mail client has crossed a boundary even if the reasoning step did not.

For security teams, local agents change the control surface rather than making it disappear. The Mac now holds model weights, tool permissions, task memory, downloaded files and execution sandboxes in one place. Full Disk Access and Accessibility can be powerful privileges. A compromised local account, malicious file, unsafe tool or overbroad folder grant can become the shortest route to sensitive information. Local execution reduces one class of third-party exposure. It increases the importance of endpoint security, operating-system updates, least-privilege permissions and a clear action log.

For buyers, this is a test of whether privacy claims can become operational evidence. Ask what runs locally, which models are downloaded, which processes can open sockets, which logs remain on device, what telemetry is sent, how updates are signed, how sandboxes are isolated and what deletion actually removes. Ask separately about every connected app. The phrase no personal data sent to the cloud is meaningful only when the product defines personal data, cloud, task boundary and user authorization in terms an administrator can inspect.

For the broader AI market, this is one more sign that useful agents are moving toward mixed compute. The future is unlikely to be all cloud or all laptop. It will be a routing problem. Private material, cheap repeated steps and offline work can stay local. Fresh research and heavy reasoning can go remote. The winner may be the system that makes that routing legible instead of the one that hides it behind the smoothest animation.

03

WHERE IT COULD HELP

• Begin with a network-off test. Disconnect the Mac, run a representative Local task and record what works, what fails and what waits. A product that claims offline operation should have an observable offline boundary.
• Capture a data-path map for each workflow. List the source files, local model, harness, sandbox, native apps, synced folders, connected services, browser use, cloud escalation, logs, backups and final destination. Mark every boundary crossing.
• Grant the smallest useful folder and app scope. A proposal task needs the proposal folder, not the entire home directory. Remove old grants after the workflow ends and review Full Disk Access separately.
• Inspect outbound traffic during Local and Hybrid runs. Record destination domains, process names, timing and payload category where policy allows. Repeat after app and model updates because a privacy receipt expires when the software changes.
• Require explicit approval before cloud escalation. The prompt should name what will leave the Mac, which service will receive it, the purpose, the expected retention and whether a redacted version can do the job.
• Keep local and cloud outputs distinguishable in the task log. A reviewer should be able to see which model produced each decision, which tool acted on it and whether the action happened inside a sandbox or a connected app.
• Test deletion and recovery. Remove the task, local model and connected folder, then verify which caches, logs, backups and synced copies remain. Privacy ends where the forgotten duplicate begins.