The next phase of artificial intelligence may not be about choosing between cloud AI and local AI.
It may be about using both.
Perplexity has introduced Perplexity Hybrid Compute, a new architecture for its Computer agent that divides complex tasks between frontier AI models running in the cloud and smaller models running directly on an Apple-silicon Mac.
The idea is straightforward but strategically important. Cloud models provide the large-scale reasoning, web research and planning that modern AI agents need. Local models handle tasks involving private files, sensitive information and applications on the user’s computer.
A privacy gate sits between the two environments.
Before protected information can leave the Mac, an on-device classifier evaluates it. Depending on the sensitivity and organizational policy, the system can keep information local, redact it, ask for approval or prevent the transfer.
That changes the traditional architecture of an AI assistant.
Instead of treating the computer as merely a client for a cloud intelligence service, Perplexity is turning the user’s Mac into another computational layer inside the agent.
Perplexity announced Hybrid Compute for Mac on September 1, 2026. It is available to Pro, Max and Enterprise subscribers through the Perplexity Mac application. The company says it works on Apple-silicon Macs running macOS 15 or later, with at least 24GB of unified memory.
The fundamental idea: one agent, two computing environments
Traditional cloud AI follows a relatively simple pattern.
A user submits information. The cloud model receives it. The model reasons over it. The answer comes back.
That model becomes complicated when an AI agent can access a user’s entire digital environment.
Consider a lawyer asking an agent to update a legal brief.
The task might require public case-law research, analysis of a confidential client document and changes to a draft stored on the Mac.
A conventional cloud agent could require sensitive documents to be uploaded.
A completely local AI system could protect the documents but might lack the strongest reasoning models, large-scale web access and computational resources available in the cloud.
Perplexity’s architecture attempts to combine the two.
The cloud side handles frontier-level reasoning, planning and web research. The Mac handles operations involving local files, sensitive information and on-device applications.
The agent coordinates the process rather than forcing the user to divide the assignment manually.
Perplexity describes this as a division in which cloud agents perform research, reasoning and planning while the local model works with private files and sensitive information.
This is more significant than simply running a local chatbot.
The local model becomes an agentic worker inside a larger distributed workflow.
How Perplexity Hybrid Compute actually works
At the beginning of a task, Computer can use cloud-based intelligence to understand the objective and construct the workflow.
It can research information on the web.
It can identify relevant sources.
It can determine which actions are necessary.
It can coordinate multiple models and agents.
When the workflow reaches a step involving information that should remain on the Mac, the architecture can delegate that step to a local model.
For example, imagine a financial analyst asking Computer to evaluate an acquisition.
The cloud agent could collect:
- Public company filings
- Industry benchmarks
- Competitor information
- Market data
- Public valuation multiples
The local model could then examine confidential projections stored on the analyst’s Mac.
The two environments can contribute to the same overall task without requiring the confidential documents to be uploaded wholesale.
Perplexity explicitly gives financial due diligence as a potential application. A local model can cross-reference confidential deal documents and material non-public information against public research performed in the cloud.
This creates a useful distinction:
The cloud provides intelligence at scale. The device provides proximity to private data.
That distinction could become increasingly important as AI agents gain access to more of a user’s digital life.
The privacy gate is the critical component
The most interesting technical element may not actually be the local language model.
It is the privacy gate.
Hybrid AI creates a difficult problem.
If an agent is allowed to access private documents locally, how does the system determine which parts of the resulting context can safely be sent to a cloud model?
A simple rule such as “keep this file local” is not sufficient.
A document may contain hundreds of pieces of information. Some may be harmless. Others may include names, addresses, account numbers, credentials, payment information or government identifiers.
The privacy gate therefore examines information before it crosses the device boundary.
Perplexity says its on-device classifier can identify sensitive information and then apply different controls. Depending on the policy, information can remain local, be masked, trigger an approval request or cause the action to be refused.
The masking approach is particularly interesting.
Sensitive values can be replaced with stand-ins before information is transmitted. The cloud model can therefore reason about the structure of the task without necessarily receiving the original identifying information.
The protected information can subsequently be restored locally.
For example:
“Prepare a response to [PRIVATE_PERSON] concerning account [ACCOUNT_ID].”
The cloud model may need to understand the relationship and context.
It does not necessarily need to know the actual person’s name or account number.
That creates a form of privacy-preserving context transformation.
It is not perfect privacy. But it represents a substantially more sophisticated approach than simply switching between “cloud” and “local” modes.
PII-TRACE: Perplexity is treating privacy detection as an AI problem
The privacy gate introduces another challenge.
AI conversations are not ordinary databases.
Personally identifiable information can appear repeatedly across a long conversation.
A user’s name might appear in the first message, an address several turns later and the same account number much later.
The system must recognize that those references belong to the same underlying identifier.
Perplexity therefore introduced PII-TRACE, short for Tracing Recurring PII Across Conversational Exchanges, alongside a compact model called PII-Tracer.
The benchmark is designed around a weakness in conventional PII detection.
Many privacy detectors are evaluated against isolated records.
Agentic AI requires something different.
The detector must operate across:
- Multi-turn conversations
- Long contexts
- Repeated identifiers
- Multiple languages
- Different writing systems
- Tables and structured data
- Mixed-format content
That distinction matters because a privacy system that catches a person’s name once but misses its subsequent appearances has not necessarily protected the conversation.
PII-TRACE evaluates whether detectors consistently identify recurring identifiers throughout conversational exchanges.
Inside PII-Tracer
PII-Tracer is deliberately small.
Perplexity describes it as a 0.6-billion-parameter bidirectional encoder adapted from the Qwen3 family. It uses padding-aware bidirectional attention and operates with a 4,096-token window.
This is an important architectural choice.
A conventional generative language model predicts the next token.
A PII detector has a different job.
It must identify the exact boundaries of sensitive information.
PII-Tracer therefore uses a token-tagging architecture.
Its tagging head supports 37 labels:
- One label for non-PII text
- Four span-position labels
- Nine PII categories
It also has a separate conversation-level classifier that determines whether the broader conversation contains sensitive material, including categories such as health or religious information.
At inference time, Perplexity uses constrained Viterbi decoding to ensure valid BIOES tagging sequences.
The result can then be mapped back to exact character spans.
That is important for a privacy gate.
It is not enough to say, “This paragraph looks sensitive.”
The system needs to know exactly which characters represent the sensitive value so it can redact, replace or route the relevant content.
The reported benchmark results are significant — but not a guarantee
Perplexity reports strong results for PII-Tracer on PII-TRACE.
The model achieved a 0.629 character-level F1 score, the highest among the 12 systems evaluated on that metric. Perplexity says larger frontier systems achieved stronger results on some span-level measurements, but those models are cloud-hosted and therefore unsuitable for screening information that must remain on the device.
The more interesting result concerns repeated identifiers.
PII-Tracer reportedly detected every mention of 79.4% of recurring identifiers and 77.6% of identifiers appearing across turns.
For comparison, Perplexity reports 57.0% and 55.1%, respectively, for GPT-5.6-sol on those measures.
The results also reveal an important limitation.
Long contexts are harder.
With a single 4,096-token window, PII-Tracer’s character recall falls as conversations become longer. Perplexity reports that 50%-overlap sliding-window decoding can raise overall character recall from 0.830 to 0.965 and multi-mention consistent detection from 0.794 to 0.954 without retraining the model.
That is a useful reminder.
A privacy classifier is itself an imperfect machine-learning system.
The privacy boundary therefore cannot be considered mathematically absolute simply because a classifier is running locally.
What happens when the classifier detects sensitive information?
Perplexity’s privacy architecture provides several possible responses.
Keep it local
The sensitive operation can be performed entirely on the Mac.
This is the strongest option when the information cannot leave the device.
Mask the information
Sensitive values can be replaced with placeholders before cloud processing.
The cloud model retains enough context to perform its task while the original information remains protected.
Ask for permission
The user can become part of the security boundary.
The system can identify the sensitive information and ask whether it may leave the Mac.
Refuse the action
The workflow can be blocked when the policy does not permit transmission.
For enterprise environments, this distinction is crucial.
Privacy cannot depend entirely on individual employees remembering which information they are allowed to put into an AI system.
Perplexity Hybrid Compute could be especially important for regulated industries
The technology has obvious applications beyond individual consumers.
Legal
Legal professionals routinely work with confidential and privileged information.
An AI agent can search public case law in the cloud while using a local model to analyze confidential documents.
Perplexity specifically describes a legal scenario in which a local model extracts facts from privileged material, turns them into anonymized research questions and combines the results with public legal research.
The key benefit is not merely productivity.
It is reducing the amount of confidential information that needs to cross a network boundary.
Financial services
Financial institutions have another obvious use case.
An investment team might need to combine:
- Public filings
- Market research
- Industry data
- Competitor information
- Confidential financial models
- Internal investment assumptions
Cloud models are particularly useful for public research.
Local models are better positioned for sensitive internal material.
This hybrid architecture can therefore fit naturally into due-diligence workflows.
Healthcare
Healthcare creates perhaps an even stronger case.
Patient information can be highly sensitive and subject to strict organizational and regulatory controls.
A local privacy boundary could allow AI agents to work with patient-related information while using cloud models for tasks that do not require identifiable data.
That does not automatically make a workflow compliant with every healthcare regulation.
Organizations would still need appropriate governance, access controls, retention policies, contractual protections and risk assessments.
But the architecture provides a potentially useful technical control.
Professional services
Consulting, accounting, recruitment, research and corporate strategy teams also routinely combine public information with confidential client information.
That makes hybrid inference relevant far beyond highly regulated industries.
Enterprise governance is where this becomes more than a Mac feature
Perplexity says Enterprise administrators can define organization-wide rules for what information must remain on the Mac, what can be masked and what requires user approval.
Admins can also audit when information leaves a device.
This matters because enterprise AI adoption increasingly depends on governance.
An employee asking an AI agent to analyze a confidential spreadsheet is not merely a productivity event.
It can become a data-governance event.
Organizations need to know:
- What data was accessed?
- What information was transmitted?
- Which model received it?
- Why was it transmitted?
- Was sensitive information masked?
- Who approved the transfer?
- Can the activity be audited later?
A hybrid architecture can potentially provide these controls closer to the point where data is accessed.
The local model is not replacing frontier AI
It is important not to misunderstand the strategy.
Perplexity is not claiming that a small local model can replace the largest frontier models.
The opposite is closer to the truth.
The local model is a specialized worker.
The cloud remains responsible for the computationally intensive portions of the workflow.
That makes the architecture resemble distributed computing more than conventional local AI.
One model may plan.
Another may research.
Another may reason.
A local model may inspect a confidential document.
The system then combines their outputs.
Perplexity’s broader Computer architecture already uses teams of agents and multiple models. Its Mac platform is designed to combine local files and applications with cloud-based AI capabilities.
Hybrid inference extends that philosophy to the privacy boundary.
Apple silicon is becoming an AI infrastructure layer
There is also a hardware story here.
Apple’s unified-memory architecture makes Macs unusually attractive for local inference.
Unlike traditional systems where CPU memory and GPU memory are separate, Apple silicon allows compute resources to work from a unified memory pool.
That does not make every Mac an AI workstation.
But it does make high-memory Macs capable of running substantially larger local models than typical consumer laptops historically could.
Perplexity says Hybrid Compute requires Apple silicon and at least 24GB of unified memory, with 32GB recommended.
The company is also optimizing its local inference stack specifically for Apple silicon and Qwen-family models. Perplexity says its lightweight inference engine, called Lily, has separate optimizations for prefill and decoding.
This illustrates a larger trend.
The personal computer is increasingly becoming an inference device.
The cloud still supplies enormous computational scale.
But the edge device supplies something the cloud cannot easily reproduce:
physical proximity to the user’s data.
A dedicated Mac mini could become an always-on AI appliance
Perplexity’s Mac strategy also creates an interesting possibility.
A Mac does not necessarily need to be the user’s primary computer.
A dedicated Mac mini can remain online and run Perplexity’s Computer environment continuously.
The user can initiate work from an iPhone and allow the Mac to perform local operations against its files and applications. Perplexity’s documentation describes the Mac mini as an appropriate always-on machine for this purpose.
That turns a relatively inexpensive desktop into something closer to a private AI appliance.
Imagine a small Mac mini sitting in an office.
It could maintain access to designated folders.
It could interact with approved applications.
It could execute local AI tasks.
It could remain available when the employee is away.
The smartphone becomes the remote control.
The cloud becomes the reasoning layer.
The Mac becomes the private execution environment.
That is a much more interesting model than simply installing a chatbot on a laptop.
Perplexity Hybrid Compute changes the meaning of “local AI”
Local AI has traditionally meant running the entire model locally.
That approach has obvious advantages.
Data stays on the device.
There is no cloud dependency for inference.
Users control the hardware.
But local models can be weaker than the largest frontier systems.
They may also have limited web access and fewer sophisticated agentic capabilities.
Hybrid AI takes a different approach.
It asks:
Which part of the task actually needs to be local?
That is a more granular question.
A 50-step workflow does not necessarily need to run entirely on the device.
Perhaps five steps involve confidential information.
Those five steps can run locally.
The other 45 can use cloud infrastructure.
This is potentially much more efficient.
It also makes the privacy discussion more precise.
Instead of saying “AI must be local,” organizations can define which information and which operations must be local.
The cost model is also interesting
Perplexity says work performed by the local model does not consume cloud credits.
That creates a second incentive for local delegation.
Privacy is one reason.
Cost is another.
If a task can be performed adequately by a local model, sending that work to an expensive frontier model may be unnecessary.
The cloud can therefore be reserved for work where its superior capabilities actually matter.
This creates an economic optimization layer on top of the privacy architecture.
The system can potentially decide:
Does this task need frontier intelligence, local execution, or both?
That is exactly the type of routing problem that agentic AI systems will increasingly need to solve.
But the privacy model introduces a new trust boundary
There is an important caveat.
Hybrid AI does not eliminate trust.
It changes where trust is placed.
In a conventional cloud architecture, the central question is:
Can I trust the cloud provider with my data?
In this architecture, another question appears:
Can I trust the local privacy gate to correctly determine what can leave my machine?
That is a fundamentally different security problem.
A classifier can make mistakes.
A false positive can reduce functionality.
A false negative can potentially expose sensitive information.
The technical sophistication of PII-Tracer is therefore important, but it does not eliminate the need for defense in depth.
Organizations should continue to use:
- Data-loss prevention controls
- Access controls
- Encryption
- Endpoint security
- Audit logging
- Human approval for high-risk actions
- Data classification policies
- Least-privilege permissions
- Model and vendor governance
The classifier should be one layer of the security architecture, not the entire architecture.
PII detection itself remains a moving target
The PII-TRACE work highlights another important issue.
Personal information is contextual.
A person’s name may be private in one conversation but public in another.
An account number is obviously sensitive in most contexts.
A project code might be confidential even though it does not resemble traditional PII.
A conversation may also contain commercially sensitive information that is not technically PII.
That means a future privacy gate will probably need to understand more than classic personally identifiable information.
It may need to detect:
PII + confidential business information + credentials + regulated data + organizational secrets.
That would turn the privacy gate into a broader data-classification engine.
That evolution could become more important than the language model itself.
Hybrid AI versus local-first AI
Perplexity is also pursuing another direction.
Its broader local-computing strategy has included local-first approaches where computation begins on the device and can escalate to the cloud with permission.
Hybrid Compute reverses that priority.
It starts with cloud intelligence and delegates sensitive work locally.
These are two different philosophies.
Local-first
Everything starts locally.
Cloud escalation occurs when necessary and permitted.
Cloud-first hybrid
The cloud orchestrates the task.
Sensitive or device-specific operations move locally.
Neither approach is universally superior.
Local-first offers a stronger default privacy posture.
Cloud-first can deliver stronger agentic capabilities because the most capable models remain in the main execution loop.
The real competition may therefore be about where the default trust boundary sits.
Why this matters for the future of AI agents
The significance of Perplexity’s announcement extends beyond Perplexity.
AI agents are becoming increasingly capable of interacting with the user’s digital environment.
They can read files.
They can edit documents.
They can operate browsers.
They can access calendars.
They can interact with applications.
They can perform research.
They can execute long-running workflows.
The more capable these agents become, the less realistic it is to treat privacy as a simple “do not upload this file” setting.
Agents need dynamic data governance.
They need to know which pieces of context can travel between systems.
They need to understand when two pieces of information refer to the same private entity.
They need to preserve privacy across multiple steps.
And they need to do this without requiring the user to manually supervise every action.
That is the problem Perplexity is attempting to address.
What Perplexity is really building
Seen from a distance, Hybrid Compute looks like a new AI feature for Macs.
Viewed more closely, it represents something bigger.
Perplexity is attempting to make model orchestration, data location and privacy policy part of the same computational system.
The cloud is no longer simply the place where AI happens.
The user’s computer is no longer simply a screen through which cloud AI is accessed.
Both become parts of the same agentic architecture.
That could eventually lead to AI systems where every task is dynamically decomposed according to three variables:
Capability. Cost. Privacy.
The most powerful model handles what requires maximum intelligence.
The local model handles what requires proximity to private data.
The system chooses between them according to policy and economics.
That is a much more sophisticated model of computing than the old cloud-versus-local debate.
The road ahead
Perplexity’s current implementation is Mac-centric.
It requires Apple silicon, macOS 15 or later and sufficient unified memory. The company has positioned the Mac mini as an especially useful always-on endpoint.
The larger question is whether the architecture expands beyond Apple’s ecosystem.
If the same privacy gate and orchestration model eventually work across Windows PCs, Linux workstations and enterprise endpoints, hybrid inference could become a more general architecture for agentic computing.
The potential is considerable.
A future enterprise agent might use a cloud model for strategy, a local model for confidential documents, a specialized model for financial analysis and another local component for endpoint actions.
The user would see one assistant.
Behind the scenes, it could be a distributed network of models operating under a common policy layer.
That is arguably where AI agents are heading.
The verdict: a potentially important architecture, not just another feature
Perplexity Hybrid Compute arrives at an important moment in the evolution of AI.
The industry has spent years pushing intelligence into the cloud because the largest models require enormous infrastructure.
It is now discovering that intelligence alone is not enough.
Agents need access to the user’s real world.
That means files, applications, private records and personal context.
Sending all of that information to the cloud creates obvious privacy and governance challenges.
Keeping everything local creates capability and performance limitations.
Hybrid inference offers a third option.
Let the cloud do what the cloud does best.
Let the device protect and process what should remain close to the user.
Then connect the two through an intelligent privacy and orchestration layer.
Perplexity’s PII-TRACE research suggests that even the privacy layer itself is becoming a sophisticated AI discipline. Its PII-Tracer model demonstrates that relatively small, specialized models can perform meaningful privacy-screening tasks locally, although the reported results also show why continuous evaluation and additional security controls remain necessary.
The broader significance is clear.
The future of AI may not be cloud versus edge.
It may be cloud plus edge, coordinated by agents that understand where data should live.
And that could be one of the defining architectural shifts of the next generation of AI computing.