The enterprise AI privacy problem has usually been framed as a choice: use the strongest models in the cloud, or keep sensitive work on a local machine and accept smaller models with tighter hardware limits. Perplexity is trying to make that choice disappear inside a single task.
On September 1, the company launched Hybrid Compute for Perplexity Computer, allowing one agentic workflow to move between frontier cloud models and a model running locally on an Apple Silicon Mac. Public web research, complex reasoning and planning can happen in the cloud, while steps involving confidential files, protected information or actions on the user's computer can be delegated to the local model without restarting the job or manually creating a separate prompt.
The architecture is described in Perplexity's official announcement and detailed further in VentureBeat's reporting. The important idea is not simply that Perplexity now runs a model on a Mac. Local AI has existed for years. The new layer is orchestration: one agent decides which parts of the same workflow belong in the cloud and which should stay on the device.
One task can now span two trust environments
Perplexity Computer acts as the coordinator. According to the company, cloud models handle frontier reasoning, web search and planning, while the local model processes private files, sensitive information and device actions. The user does not have to split the job into a public half and a confidential half.
That matters because real knowledge work rarely respects a clean boundary between public and private information. A lawyer may need public case law and privileged client documents in the same analysis. An investment team may need market data from the web alongside confidential management projections. A sales executive may need external research combined with customer records stored locally.
Cloud-only agents create an obvious governance question in those scenarios: how much confidential context must leave the organization for the model to complete the work? Fully local agents solve that problem at the cost of access to the largest frontier models and, often, cloud-based search and data services. Hybrid Compute attempts to make the boundary dynamic rather than architectural.
The Privacy Gate decides what can leave the Mac
The central control is what Perplexity calls its Privacy Gate. It runs on the Mac and examines information before protected data is transmitted to the cloud. Perplexity says the gate can mask sensitive details, keep information local, refuse the requested action or ask the user for permission.
VentureBeat reports that Perplexity built its own on-device classifier to identify personally identifiable information and other sensitive content. Details such as credentials, payment-card numbers and government identifiers can receive stronger treatment. If a subtask is delegated locally, Perplexity says the associated tokens do not go to the cloud.
This changes the privacy boundary from an entire application to individual pieces of work. The cloud agent may know that it needs public research about a legal question without receiving the privileged documents that generated the question. The local agent can analyze those documents and return only the information the orchestration layer is permitted to use.
The privacy promise depends on routing being correct
Hybrid architecture does not eliminate privacy risk; it moves some of that risk into the classification and orchestration layer. A Privacy Gate is still software making a judgment about what is sensitive. If it fails to recognize protected information, data intended to remain local could be transmitted to the cloud.
That makes false negatives more consequential than in an ordinary content classifier. The question is not whether a label is slightly inaccurate. It is whether confidential information crosses a trust boundary.
Perplexity's answer is to combine automated detection with user control and enterprise policy. Users can review protected information and decide whether it may be shared, while enterprise administrators can define organization-wide rules for what must remain local, what may be masked and what requires approval. VentureBeat also reports that enterprise customers can audit information leaving individual devices.
The model is therefore closer to a security gateway than a simple model selector. The product has to understand not only which AI is best for a task, but also which AI is allowed to see the data required to complete it.
Cloud models remain responsible for the hardest general reasoning
Perplexity is not arguing that small local models have caught up with the best cloud systems. Its design assumes the opposite. Frontier models remain useful for long-horizon planning, web research and difficult reasoning, while local models are valuable because they can operate close to private data.
That separation lets the system optimize for different constraints. The cloud has far more compute and access to large models. The Mac has physical proximity to the user's files and can process them without uploading their contents to a remote provider.
The agent's job is to combine those advantages. A local model does not need to outperform a frontier model at every cognitive task if it can competently perform the sensitive portion and pass an approved result back into the larger workflow.
Perplexity is turning model routing into a security feature
Multi-model routing is already a common idea in AI products. Systems can send easy requests to cheaper models and difficult ones to more capable models, reducing cost while preserving quality. Hybrid Compute extends that principle to privacy.
The routing decision now considers where computation happens, not just which model performs best. One subtask may be assigned to a cloud model because it needs strong reasoning. Another may be assigned locally because the data cannot leave the machine. The optimal model becomes the model that satisfies both capability and policy constraints.
This could become an important pattern for enterprise agents. Organizations rarely have one universal data policy. Public information, internal documents, regulated records, credentials and client-confidential material often have different handling requirements. An orchestration system that can map those classifications to different execution environments may allow AI to reach workflows that cloud-only products struggle to enter.
Perplexity's demonstrations target exactly those restricted workflows
VentureBeat describes demonstrations in legal and financial work designed to show why hybrid execution matters. In one, a lawyer used privileged case files stored on a Mac while the cloud side researched public case law. Perplexity said the privileged information remained on the device while anonymized questions could be used for external research.
In another demonstration, a private-equity associate combined confidential management projections with public comparable-company research while the agent revised a financial model and investment-committee material. The company also demonstrated a user initiating work remotely from an iPhone while a Mac elsewhere performed the sensitive local processing.
These are demonstrations rather than independent productivity studies, so they should not be read as proof that every law firm or investment team can immediately automate equivalent work safely. They do illustrate the product's intended market: valuable tasks where public research and confidential context have to coexist.
The local model can keep working even when the user is away from the Mac
Perplexity's architecture also separates local execution from physical presence. The company says Computer works with iPhone, allowing users to send prompts remotely while a Mac processes protected information locally.
A dedicated Mac mini can function as an always-on private execution node. That gives the hybrid model some characteristics of private enterprise infrastructure without requiring an organization to build its own GPU server environment.
The concept is especially interesting for professionals who already keep sensitive working files on a Mac. Instead of uploading those documents to a new AI workspace, the agent can be brought to the machine where the information already lives.
Hybrid Compute requires Apple Silicon and substantial memory
The feature is available through the Perplexity Mac app to Pro, Max and Enterprise subscribers. Perplexity says it works on Apple Silicon Macs running macOS 15 or later with at least 24GB of unified memory.
That requirement is a reminder that local AI still has hardware costs. Running useful language models on-device consumes memory and compute that ordinary productivity applications do not require. Larger local models can also offer materially better performance than compact alternatives.
At launch, Perplexity lists three local choices: Google's Gemma 4 E4B, Qwen3.6 35B-A3B and a Perplexity model. VentureBeat reports that the company recommends its post-trained Qwen-based option for stronger local performance.
Open-weight models change the geopolitical question
The use of Qwen, originally developed by Alibaba, prompted questions during the VentureBeat briefing about whether enterprises or government users would be comfortable giving a Chinese-developed model access to sensitive files.
Perplexity's argument is that local open-weight inference changes the threat model. The weights are downloaded and run on the user's Mac; the confidential tokens are not sent to Alibaba or another foreign cloud service merely because the model originated there. Perplexity says it can evaluate the open weights itself.
That distinction is technically important, although organizations may still have procurement or compliance policies governing model provenance. A locally executed open-weight model is not equivalent to sending data to the model developer's hosted API, but enterprises may still want to evaluate the software supply chain, license, model behavior and update process.
Local execution also changes the economics of agentic work
VentureBeat reports that Perplexity does not charge cloud-compute credits for tokens generated locally. The user has already paid for the Mac and electricity, so the metered service cost applies to cloud orchestration and delegation rather than on-device inference.
That creates a second incentive for hybrid routing beyond privacy. Repetitive or data-heavy local work could be cheaper to perform on hardware the customer already owns, reserving expensive frontier-model usage for the parts of the workflow that genuinely benefit from it.
Enterprise AI architecture may therefore converge on a combination of factors: send a task to the environment that provides sufficient intelligence, satisfies data policy and minimizes unnecessary compute cost. Privacy is the headline, but cost-aware orchestration could become equally important at scale.
Perplexity is building toward an agent that spans the entire computer
Hybrid Compute builds on Personal Computer, which Perplexity introduced earlier in 2026. The Mac product can work with local files, control native applications, use the Comet browser and continue tasks in the background. Perplexity describes Computer more broadly as an orchestration layer capable of creating teams of agents across more than 20 frontier models.
The company had already explored the opposite hybrid direction in August with Portable Computer on Nvidia DGX Spark hardware: start locally and escalate to cloud capabilities when needed. The new Mac feature can begin with cloud orchestration and delegate protected work down to the local device.
Together, those approaches suggest that Perplexity does not view “local versus cloud” as a permanent product choice. It views location as another variable for the orchestrator to manage.
Security still depends on more than keeping data local
Local processing is useful, but it should not be confused with complete security. An agent capable of reading files and controlling applications can cause harm without ever sending data to the cloud. It could modify the wrong document, act on a misleading instruction embedded in local content or attempt an operation outside the user's intent.
Perplexity says Computer uses sandboxing and on-device authorization to constrain sensitive actions. VentureBeat reports that the Mac implementation relies on operating-system sandboxing and can request permission when local execution attempts restricted behavior.
This is an important distinction for agent security. Privacy asks where data goes. Safety also asks what the agent can do. A genuinely enterprise-ready local agent needs controls for both.
The hybrid model could be more important than any specific local model
Today's local models will not be the models used two years from now. Apple Silicon will become faster, open-weight models will improve and cloud frontier models will continue to change. The durable part of Perplexity's announcement may therefore be the orchestration pattern rather than the launch model lineup.
If the system can swap in better local and cloud models without changing the user's workflow, improvements on either side make the whole agent more capable. The local component can gain better reasoning while preserving privacy, and the cloud component can gain stronger planning without receiving more sensitive information.
That modularity is strategically attractive. Perplexity can position itself above individual model providers, choosing whichever combination best satisfies the task and the user's policy.
Enterprise AI may become less about where the agent lives
The first generation of enterprise generative AI was often divided by deployment model. A company chose a cloud service, a private cloud, an on-premises model or a local application. Agentic systems make those boundaries less natural because one task can involve many tools, data sources and levels of sensitivity.
Hybrid Compute proposes a different abstraction: the user describes the objective, and the agent determines where each step is allowed to execute. If that model works reliably, employees do not need to become infrastructure coordinators simply to keep a confidential spreadsheet off the internet.
But the simplicity of the user experience depends on sophisticated policy underneath it. Someone — an administrator, a classifier or the user — still has to decide what counts as sensitive and what can safely cross the boundary.
The real product is the boundary between local and cloud AI
Perplexity's new feature is easy to describe as local AI for the Mac, but that misses the more interesting shift. The company is building an agent that can inhabit two computing environments during the same job and treat the boundary between them as part of its reasoning process.
That could unlock professional workflows that have remained resistant to cloud agents because the most useful context is also the context organizations are least willing to upload. It also creates a new security dependency: users have to trust the system that decides what stays private.
The strongest version of hybrid AI will not be the one that runs the most tasks locally or the one that sends everything to the biggest cloud model. It will be the one that consistently puts each piece of work in the right environment — and can prove that sensitive information stayed where policy said it should. Perplexity's Hybrid Compute is an early attempt to make that routing decision invisible to the user while keeping the privacy boundary visible enough to audit.