Perplexity Now Runs the Private Half of a Task on Your Mac

On September 1, 2026, Perplexity released Hybrid Compute for the Perplexity Mac app. It changes how Perplexity Computer, the company’s agent product, executes a task: the task begins in the cloud, and the steps that involve private files or sensitive data run on the user’s own Mac with a locally installed model. Work done locally uses no cloud credits and needs no API key. It is available to Pro, Max and Enterprise subscribers on Apple silicon Macs with at least 24 GB of unified memory.

The idea of running a model on a laptop is not new, and neither is an agent in the cloud. What is new is a mainstream product drawing the line between the two by the sensitivity of the data rather than by cost or speed, and putting an on-device classifier at the line to enforce it. That design is the part worth understanding, because it is the one other agent products will copy.

Perplexity’s own announcement page returns an access error to automated readers, so the facts below are drawn from its launch materials as reported on the day by 9to5Mac and MarkTechPost, and from Perplexity’s statements quoted in them. Where the two reports differ in detail, both versions are given.

Perplexity describes the flow in one sentence: “Computer starts each task in the cloud. Trigger one from your iPhone, and your Mac accesses your files and runs sensitive steps locally.” The cloud side is the part that benefits from a frontier model and a search index: understanding the request, breaking it into steps, and fetching public information. The local side is the part that would otherwise require uploading your data: opening a contract from the desktop, reading a spreadsheet of customer records, filling a form with an account number. The two halves share one task state, so the local step does not restart the job or lose what the cloud already worked out.

Two consequences follow. The first is that the quality of the local half is bounded by a 27-billion-parameter model on a laptop, not by whatever frontier model Perplexity routes the planning to. Perplexity post-trained that model for Computer’s tasks specifically, which is the sensible mitigation, but a user should expect the private steps to be the less capable ones. The second is that the boundary is now a product feature with a visible behaviour, which is a different thing from a privacy policy. When the gate masks, refuses or asks, the user sees the decision. That is the design choice we would most like to see copied.

Perplexity’s description, as quoted by 9to5Mac: “Our on-device PII classifier reads each task on the Mac before it is sent. Names, addresses, and account numbers are swapped for stand-ins, then restored when the answer returns.” PII means personally identifiable information. MarkTechPost’s account adds the four outcomes the gate can apply, keep local, mask the sensitive spans, refuse the action, or ask the user, and says credentials, payment card numbers and government identifiers get the strictest handling.

The same report identifies the classifier as PII-Tracer, a 0.6-billion-parameter bidirectional encoder built on a Qwen3 backbone that labels 37 categories across nine types of personal data, and quotes detection figures: a character-level F1 score of 0.629, described as the highest among twelve detectors compared, 79.4% consistency at recognising the same identifier when it recurs, and single-window recall falling to 0.687 on inputs over 10,000 characters, recovered to 0.965 with sliding-window decoding. Those are Perplexity’s numbers and we have not reproduced them; the honest reading is that the gate is a reasonably strong detector with a documented weakness on long inputs that the product works around.

The requirement that will exclude the most people is memory. A 27-billion-parameter model needs room, and Perplexity sets the floor at 24 GB of unified memory with 32 GB recommended. That rules out every Mac configured with 8 or 16 GB, which covers the base MacBook Air and base MacBook Pro of recent years and a large share of the installed base. In practice the audience is people who bought a Mac with memory in mind, or whose employer did. The feature is also Mac-only at launch; Perplexity’s Windows agent work, covered in our July post on Computer for Windows, has no equivalent announced.

Strip the brand away and the architecture is: a capable model somewhere else does the thinking, a smaller model nearby does the touching, and a classifier at the seam decides which is which per step. That is a general design for any agent that handles both public and private information, and it answers the objection that has kept many businesses from letting agents near their files at all. It does so at the cost of a second model to maintain, a classifier whose errors are now the product’s errors, and a hardware floor.

For a business evaluating agents against client data, the useful question is not whether to buy Perplexity’s version but whether your own agent workflow has a seam at all. Most do not; the same model that plans also reads the customer list, and the whole context goes to one API. The Perplexity design shows the seam can be a product feature. Our earlier on-device agent forecast set out the cost and privacy stack that makes it possible; this launch is the first mainstream instance of it shipping in a consumer agent.