Perplexity today launched hybrid compute for its agentic platform, Computer, a system that lets a single AI agent split its work between frontier models running in the cloud and smaller open-weight models running locally on Apple silicon Macs — routing sensitive data to the local machine so it never leaves the device.
The company says it is the first time an AI agent can begin a task in the cloud and dynamically hand off the confidential portions of that same task to a model running on the user’s own hardware, without restarting the job or losing context. The feature becomes available today through Perplexity’s desktop app for enterprise customers that opt in, as well as Pro and Max subscribers, on any Apple silicon Mac running macOS 15 or later.
“Hybrid is really compelling because it’s often the work that requires confidentiality that is the most important to get right, and so the accuracy really, really matters,” Jon Staff, who leads Perplexity’s macOS and iOS engineering teams, said during a press briefing attended by VentureBeat. “By combining these two together, we can get that maximum intelligence from the frontier models, but we also get the security and the privacy that comes with local.”
How Perplexity’s on-device privacy gate keeps sensitive data off the cloud
The architecture works like a dispatcher. A frontier model in the cloud breaks a task into subtasks and routes each one to the appropriate place. Web research, long-horizon planning and heavy reasoning run in the cloud, while anything touching private files, local data or actions on the device gets delegated down to a subagent running on the Mac itself.
The linchpin is what Perplexity calls a Privacy Gate: a company-trained classifier that runs on the device and scans for personally identifiable information — names, addresses, account numbers, secrets — before anything is transmitted to the cloud. When the gate flags sensitive content, the user chooses whether that portion of the task runs locally or gets shared.
“What we wanted to do is make sure anything that’s shared to that cloud orchestrator is safe,” Staff said. “We built and trained our own PII classifier that integrates directly into the Mac app.”
He described the handoff in detail: “The cloud orchestration will break down the task based on the prompt and figure out how to route it to different subagents… it’s going to delegate that down to a sub-agent running on your Mac, and then that portion of the task is run entirely local. None of those tokens go to the cloud.”
The economics matter, too, for a company that meters cloud usage through credits. Tokens generated locally cost nothing. “You’re paying for the electricity, you’re paying for the hardware, so we’re not charging you for that,” Staff said. “The only thing the credits are used for is the orchestration and the delegation.”
Lawyers, private equity firms and a founder in an Uber: hybrid compute in action
Perplexity built its demonstrations around exactly the kind of work most professionals would never hand to a cloud-only agent. In the first, a lawyer on deadline updated a draft brief against privileged case files stored on a Mac while a cloud agent simultaneously pulled public case law from the open web — sending out, Perplexity says, only anonymized legal questions. “At no point did their privileged information get shared to the cloud,” Staff said. “It never left the Mac.”
In the second demo, a private equity associate’s agent reworked a financial model against confidential management projections, benchmarked the deal against public comparables and produced a fifth iteration of an investment committee deck. The task ran roughly 40 minutes in the background with no human input — work that would have taken hours of manual stitching between local spreadsheets and cloud research.
The third demo emphasized continuity across devices. The founder of a pottery shop, riding in the back of an Uber, kicked off a marketing analysis from her iPhone. Computer asked permission to reach her Mac at the studio, fired up the local subagent to process her customer interviews and revenue data, and combined that with cloud research on competitors’ public pricing. “It doesn’t matter how far away she is from her computer,” Staff said.
“Tasks like this aren’t possible in a fully local or a fully cloud setup,” he added. “You need that security of the local and the privacy, but you also need the intelligence of the frontier.”
Why a Chinese-made Qwen model on enterprise Macs is raising eyebrows
The launch model lineup immediately raised a pointed question. At launch, users can choose among three local models: Google’s Gemma E4B, Alibaba’s Qwen3.6 35B-A3B, and a Perplexity post-trained version of Qwen3.6 35B — the company’s recommended option. Asked by VentureBeat whether enterprise or government customers had raised concerns about giving a Chinese-developed model access to their machines, Staff argued that local inference neutralizes the geopolitical risk.
“The great thing about these models is that they are open weight. We’re able to evaluate them ourselves,” he said. “When that model is running locally on your computer, the data is not going outside of your computer itself… You’re not actually sending those tokens to some cloud provider that’s hosted in another country. In fact, all of Perplexity’s models are U.S. hosted.”
He added that macOS’s built-in sandboxing framework, known as Seatbelt, constrains what the agent can actually do on a machine: “If local execution is trying to do something that it shouldn’t, it’ll just point blank stop it and it’ll request permission from the user.” Perplexity does not currently allow unrestricted “YOLO mode” execution, he said, though “I wouldn’t be surprised at some point if we allow certain people to do this.”
For enterprises, admins can set a single organization-wide sensitivity policy and audit a full record of what leaves each device — a feature aimed squarely at compliance teams in law, finance and healthcare. Questions remain on the consumer side, however. Pressed on how usage data feeds model training, Staff pointed to Perplexity’s incognito mode and a long-standing opt-out toggle, and said enterprise contracts can include zero-data-retention terms. A company spokesperson said Perplexity is “not using it for post training” globally and promised to follow up with specifics on non-enterprise accounts.
The enterprise privacy problem hybrid AI is trying to solve
The announcement lands amid a broader industry reckoning with a stubborn problem: the most valuable enterprise work involves exactly the data companies are least willing to send to someone else’s servers. NIST’s generative AI risk profile flags data privacy and information leakage among the technology’s central risks, and McKinsey’s research on the state of AI has consistently found that organizations struggle to move from experimentation to value capture, with data governance among the chief obstacles. Gartner, for its part, named hybrid computing among its top strategic technology trends for 2025, anticipating architectures that blend compute across environments.
Perplexity is betting that the answer is not choosing between cloud intelligence and local privacy, but building the orchestration layer that arbitrates between them in real time. It is a defensible position for a company that has always styled itself as a neutral broker — “Perplexity is like Switzerland in that we work with everyone,” a company representative said at the briefing — sitting at the application layer above whichever models happen to lead at any given moment.
“Anytime one of these gets better, Perplexity gets better,” Staff said of the interplay among local models, frontier models and Apple’s chips. “That’s the really cool nature of where we sit in this application layer, orchestrating all the different pieces together.”
From $520 million startup to $20 billion agent platform in three years
Hybrid compute caps an extraordinarily aggressive product run. Perplexity launched its Comet AI browser in July 2025, initially for $200-a-month Max subscribers — an early bid to make agents, not chat, the interface to computing. Computer, its full agentic platform, arrived in March 2026, followed by desktop apps for Mac and Windows. Just last week, the company launched a local-first version of Computer on NVIDIA’s DGX Spark hardware, which starts on the user’s device and escalates to cloud models only with permission. Today’s launch inverts that flow: cloud-first, delegating down.
The business trajectory has been equally steep. Perplexity was valued at $520 million in January 2024; by September 2025, the company had finalized a funding round at a $20 billion valuation. Along the way it made an audacious $34.5 billion bid for Google’s Chrome browser during Google’s antitrust remedies fight, and Bloomberg reported that Apple executives held internal talks about acquiring the company — a striking backdrop for a product now built to showcase Apple silicon.
The strategy is not without headwinds. Reuters reported in July that Reddit’s data-scraping lawsuit against Perplexity survived a motion to dismiss, part of a wave of copyright and data litigation facing the company — context that makes its privacy-forward positioning both commercially savvy and reputationally necessary. And practical constraints remain: Perplexity recommends at least 32GB of unified memory for the better tier of local models, Staff was candid that the smallest option “significantly underperforms” the larger Qwen models, and Windows and Linux support will come only later.
The deeper question is one users cannot easily inspect. The Privacy Gate is itself a machine learning classifier, and classifiers miss things; a false negative means sensitive data reaches the cloud anyway. Perplexity’s answer is transparency — users can expand and review exactly what the gate flagged before anything is sent, and enterprises get device-level audit logs. But the pitch, at bottom, asks professionals to trust one AI to decide what another AI is allowed to see. For an industry that has spent three years telling lawyers, bankers and doctors to keep their most sensitive work away from the cloud, Perplexity’s wager is that the fix was never to build a higher wall — it was to build a smarter gate.