Perplexity’s Mac app just started treating some of your data as too sensitive for its own servers. That’s a strange thing for an AI company to build — and it’s the whole point.

On September 1, Perplexity launched hybrid compute for the Perplexity Mac app, available now to Pro, Max, and Enterprise subscribers. It splits every Perplexity Computer task in two. The reasoning, the web search, the planning — that still runs on frontier models in the cloud, same as before. Anything that touches a private file, sensitive personal data, or an action performed directly on your Mac gets handed to a model running locally, on the machine itself, so it never leaves the device at all.

The timing isn’t incidental. Days earlier, Forcepoint X-Labs published a proof-of-concept showing that invisible HTML embedded in an email could silently hijack what an AI assistant reports back to a user — no malware, no visible tampering, just text a human never sees and a model that reads everything indiscriminately. We covered that report here. Perplexity’s announcement doesn’t mention Forcepoint by name. It doesn’t need to. The anxiety driving both stories is the same one: AI assistants ingest everything you hand them, and users have no reliable way to know what happens to it after that.

Quick Summary: What Shipped

Detail	Info
Launched	September 1, 2026, for the Perplexity Mac app
Who gets it	Pro, Max, and Enterprise subscribers
What it does	Splits each Perplexity Computer task — cloud handles reasoning, search, and planning; a local model handles private files, sensitive data, and on-device actions
Local models	Gemma 4 E4B, Qwen3.6 35B-A3B, and a Perplexity-trained model
Requirements	Apple silicon Mac, macOS 15+, 24GB unified memory minimum (32GB recommended)
Cost	Locally-run work uses no cloud credits
Official source	Perplexity’s launch announcement

Bottom line: Perplexity is betting “your sensitive data doesn’t reach our servers, period” is a stronger claim than any privacy policy, and it’s backing that up by open-sourcing the classifier that makes the routing decision.

What Actually Happened

According to Perplexity’s own announcement, hybrid compute lets a single Perplexity Computer task move between environments without the user restarting anything or managing a handoff. A task can begin in the cloud — planning, searching, reasoning through a problem — and then shift to a local model the moment it touches something private: a folder of financial documents, a contacts list, an email full of client names.

That routing decision is handled by what Perplexity calls the Privacy Gate, an on-device classifier that inspects a task before anything gets transmitted. Coverage from Unite.AI and MarkTechPost describes four possible outcomes once the gate flags something: mask the sensitive spans and continue in the cloud, keep the entire step local, refuse the action outright, or stop and ask the user directly. Credentials, payment card numbers, and government IDs get the strictest handling by default.

Three local models ship at launch, per 9to5Mac’s reporting: Google’s Gemma 4 E4B, Alibaba’s Qwen3.6 35B-A3B, and a version of that Qwen model Perplexity post-trained specifically for Computer tasks. All three require an Apple silicon Mac running macOS 15 or later, with a minimum of 24GB of unified memory — Perplexity recommends 32GB, and VentureBeat’s reporting notes the smaller memory tier “significantly underperforms” the larger Qwen option in practice. That’s a real cutoff: plenty of Macs currently in professional use don’t clear 24GB, and hybrid compute simply won’t run on them.

Jon Staff, who leads Perplexity’s macOS and iOS engineering, put the tradeoff plainly in comments to VentureBeat: “By combining these two together, we get that maximum intelligence from the frontier models, but we also get the security and the privacy that comes with local.” That’s the pitch in one sentence — don’t force a choice between capable and private, split the task so each half gets handled where it belongs.

What Is Perplexity’s Privacy Gate?

Perplexity’s Privacy Gate is an on-device classifier that scans a Computer task before any part of it leaves your Mac. It flags names, addresses, account numbers, and other personal details, then applies one of four responses: mask the sensitive spans, keep the whole task local, block the action, or ask the user for approval before proceeding.

How Hybrid Compute Routes a Task

1. You give Perplexity Computer a task that touches a private file, account, or sensitive detail.
2. The on-device Privacy Gate scans the request before anything transmits.
3. Non-sensitive reasoning, search, and planning steps route to frontier cloud models as usual.
4. Sensitive spans get masked with stand-ins, or the entire step runs on Gemma 4 E4B, Qwen3.6 35B-A3B, or Perplexity’s own local model instead.
5. When the cloud model finishes, masked values swap back into the final answer — so the response reads normally, but the raw personal data never crossed the network.

That last step is the detail worth sitting with. Perplexity isn’t just hiding sensitive data from the response — it’s substituting stand-in values, running the cloud portion of the task on the substitutes, then reconstituting the real data locally once the answer comes back. The cloud model never sees the actual name, address, or account number it’s reasoning about.

The classifier doing the flagging is called PII-Tracer, and Perplexity open-sourced it. It’s a compact 0.6-billion-parameter model built on a Qwen3 backbone, trained to tag nine categories of personal information across a task before anything ships. Perplexity paired the release with a benchmark, PII-TRACE, built from more than 13,000 synthetic conversations across 13 languages — meant to test whether a detector catches every mention of a recurring identifier, not just the first one. According to MarkTechPost’s coverage, detection accuracy on that benchmark drops noticeably on longer conversations — recall falls from roughly 0.975 on exchanges under 1,000 characters to about 0.687 once a conversation passes 10,000 characters. Worth knowing if you’re planning to lean on this for anything approaching a full workday’s context.

Why This Matters

Every AI company building agentic tools runs into the same wall eventually: to be useful, the agent needs access to your real files, your real accounts, your real inbox. To be trustworthy, it needs a story for what happens to that access once granted. Most companies answer with a privacy policy. Perplexity is answering with an architecture decision — data that shouldn’t leave the device structurally can’t, rather than structurally can but promises not to.

That’s a meaningfully different claim, and it lands at a moment when the industry’s trust problem has a fresh, specific shape. The Forcepoint report wasn’t about data leaving a device — it was about an AI assistant being manipulated by content it was asked to read, with no visible sign anything had gone wrong. Hybrid compute doesn’t fix that particular failure mode. A model tricked by hidden instructions is tricked whether it’s running in the cloud or locally on a Mac. What hybrid compute does is shrink the blast radius: if a compromised or manipulated task never sends your account numbers and client names to a remote server in the first place, there’s less to expose even when something else goes wrong upstream.

Open-sourcing PII-Tracer is the part that signals Perplexity wants this taken seriously rather than treated as a marketing checkbox. A closed, in-house PII filter is a promise. A published model with a published benchmark is something enterprise security teams can actually test against their own data before deciding whether to trust it.

What Are Your Options Now

If you’re already on Perplexity Pro, Max, or Enterprise Pro on a Mac, hybrid compute should be available in the current app — check that you’re on Apple silicon with macOS 15 or later and at least 24GB of unified memory before expecting it to engage. Below that, the feature isn’t available yet.

If your Mac doesn’t meet the hardware bar, nothing changes for you today. Your Computer tasks continue running entirely in the cloud, under whatever data-handling terms already applied. That’s not a downgrade from what existed before hybrid compute shipped — it’s the same setup Perplexity has run since Computer launched in February.

If you’re evaluating Perplexity for a team, the open-sourced PII-Tracer classifier and PII-TRACE benchmark give your security or compliance staff something concrete to test rather than a policy document to take on faith. Compare that posture directly against the data-handling terms in our Perplexity Enterprise Pro vs. ChatGPT Team vs. Claude for Teams breakdown before deciding whether it changes your procurement calculus.

The Bigger Picture

Hybrid compute only works because open-weight models got good enough, and Apple silicon got powerful enough, to run a real reasoning model on a laptop without a dedicated GPU. Gemma and Qwen weren’t credible options for this kind of task two years ago. Now Perplexity is shipping them as the default local half of a production feature used by paying subscribers, not a research demo.

It also fits a pattern that’s shown up across the industry all year: AI companies increasingly treat “processed entirely on your device” as a premium claim rather than a limitation. Perplexity Computer’s rapid growth — Perplexity’s agentic platform crossed $450 million in annual recurring revenue within a month of launch — has pushed the company’s highest-spending customers toward exactly the kind of workflows where sensitive data exposure is the real objection. Hybrid compute reads like a direct response to that friction: give enterprise buyers and security-conscious professionals a concrete reason the answer to “where does my data go” isn’t just “trust us.”

Whether competitors follow with their own local-routing architectures is the obvious next question, and one worth revisiting once a few of them have actually shipped something comparable rather than just talked about it.

Our Take

We think this is a genuine architecture change, not a repackaged privacy policy, and that distinction matters. Masking PII before it reaches a cloud model and restoring it afterward is a real technical commitment, and open-sourcing the classifier that makes the call is the kind of move that’s expensive to fake — you can’t open-source a filter that doesn’t actually work and expect nobody to notice.

That said, keep two limits in view. First, the 24GB-minimum, Apple-silicon-only requirement means this is a Mac feature for people with recent hardware, not a general privacy upgrade for every Perplexity user. Second, masking names and account numbers doesn’t erase everything else a piece of text can reveal about who wrote it — context, phrasing, and unmasked details can still narrow down an identity even after the obvious fields are swapped out. PII-Tracer’s own recall numbers dropping on longer conversations is a reminder that this is a strong mitigation, not a guarantee. Treat hybrid compute as raising the floor on what’s exposed, not as a reason to stop thinking about what you hand any AI assistant in the first place.

Frequently Asked Questions

Q: What is Perplexity’s hybrid compute feature? A: Hybrid compute is a Perplexity Mac app feature, launched September 1, 2026, that splits each Perplexity Computer task between cloud-based frontier models and a model running locally on the Mac. Sensitive data and private files get processed on-device instead of being sent to Perplexity’s servers.

Q: Who can use hybrid compute? A: Perplexity Pro, Max, and Enterprise subscribers, on an Apple silicon Mac running macOS 15 or later with a minimum of 24GB of unified memory (32GB recommended).

Q: What local models does hybrid compute use? A: Three at launch — Google’s Gemma 4 E4B, Alibaba’s Qwen3.6 35B-A3B, and a version of that Qwen model Perplexity post-trained specifically for Computer tasks.

Q: What is the Privacy Gate? A: The Privacy Gate is the on-device classifier — built on a model Perplexity calls PII-Tracer — that scans a task before anything is transmitted to the cloud. It detects personal information like names, addresses, and account numbers and either masks it, keeps the task local, blocks it, or asks the user for approval.

Q: Does using the local model cost extra? A: No. Perplexity’s announcement and VentureBeat’s reporting both note that work processed locally consumes no cloud credits — you pay in electricity and hardware, not subscription usage.

Q: Did the Forcepoint prompt injection report cause this launch? A: Perplexity’s announcement doesn’t cite Forcepoint’s report directly, and a feature like this takes longer than a week to build. But the timing — hybrid compute shipping days after a widely covered demonstration that AI assistants can be manipulated by hidden content — makes the privacy framing land harder than it would have a month earlier.

Q: Is the PII classifier actually open source? A: Yes. Perplexity released PII-Tracer along with a benchmark called PII-TRACE, giving outside researchers and enterprise security teams a way to test the classifier’s accuracy independently rather than taking Perplexity’s claims on faith.

---

Last updated: September 2, 2026. Sources: Perplexity — Introducing Hybrid Compute on Mac · 9to5Mac · VentureBeat · Unite.AI · MarkTechPost · Forcepoint X-Labs.

Related reading: Perplexity AI Review 2026 · Perplexity’s $450M Pivot: From Search to Agents · AI Email Assistants Can Be Hijacked With Invisible Text · Perplexity Enterprise Pro vs. ChatGPT Team vs. Claude for Teams