The Agent Moved Onto Your Machine: A Local / Hybrid / Cloud Rule for Every Task — and the Privilege Problem It Brings Home

For solo operators, founders, and technical builders who run — or are about to run — an AI agent against their own files, mail, and work, and are deciding where that agent should execute.

---

The first screen: the whole agent now runs on the machine that already holds your files

On October 20, 2026, Perplexity shipped Computer fully local on Mac: the AI model, the harness, and the task execution all run on device. With permission, it works across your local files and native Mac apps — Notes, Messages, Mail, Numbers — and, in the company's words, "without sending personal data to the cloud." Code and tool execution run in isolated sandbox environments. (Perplexity — Computer runs fully local on Mac.)

Sit with what that reverses. For two years the default deal was: a capable agent means the frontier model in the cloud, so your private data leaves with it. This is the first widely-shipped product where the entire agent runs on the machine you already own, and the frontier is demoted to something you authorize — not something you depend on.

Perplexity did not hide the seam; they productized it. The Mac app offers two ways to run Computer: Hybrid Compute "starts in the cloud, coordinating research and reasoning with local work on private files," while running locally "starts on the Mac, keeping the task's planning, reasoning, and file processing on device." Users can authorize escalation to the cloud for current information, browser use and connected apps, and — the line that matters for the bill — "the local orchestrator can call on one of 15+ frontier models for advanced reasoning." Work the local model handles does not consume Computer credits. (Perplexity launch post; Perplexity X post.)

The launch is one product. The thing it makes visible is the decision you were already making by accident. A wave of on-device capability landed in the same ~48-hour window: Meta's Muse Glimmer 30B (Apache-2.0, distilled from Muse Spark, quantised to ~17–20GB), Muse Spark Open scoring 38.9 on Artificial Analysis' Intelligence Index, Ornith 1.5 122B open weights under MIT, NVIDIA's Nemotron 3.5 pair, and DeepSeek open-sourcing DeepInfer, "the high-performance inference framework that powers DeepSeek's large-scale production services." (InfoQ; Artificial Analysis; Ornith 1.5 122B; DeepInfer.)

By the end of this piece you have two things you can use this week:

  • A per-task routing rule** — classify each task on two axes (how sensitive is the context, how hard is the reasoning) and it falls into local, hybrid, or cloud escalation. This is the decision Perplexity built into its product; you can apply it to your own agent today, on any vendor.
  • A privileged on-device agent checklist** — five controls for the fact the launch framing skips: an agent that reads your Mail, your Messages and your files and executes code is not a chatbot on your laptop. It is a privileged actor on your machine.

Here is where we are going:

  • The decision people are actually making** — not "which model," but "where should this task run?"
  • The two axes that decide it** — sensitivity × difficulty, and the mechanism that made local viable at all.
  • Local / hybrid / cloud on the dimensions that matter** — where each is the right call and where it is the wrong one.
  • The decision table** — the reusable object, and the privilege checklist.
  • The misunderstanding that trips everyone** — "local is private and cheap," and why both halves are half-true.

---

1. The decision people are actually making

The framing everyone reaches for is a model choice — "should I run a 30B local model or call the frontier?" That is the wrong axis, and it is why the argument never resolves. A model does not run a task; a plane does.

The real decision has three answers, and a shipped product now puts all three in the user's hand:

  • Local** — the model and the harness run on your machine; planning, reasoning, file processing and the finished output never leave it. (Perplexity launch post.)
  • Hybrid** — the task is divided: cloud models handle planning, web search and reasoning while a local model processes private files and sensitive steps. (Perplexity help centre.)
  • Cloud escalation** — the local orchestrator hands the hard step to one of 15+ frontier models, and this is the step that consumes credits. (Perplexity launch post.)

Perplexity frames it as control — "the choice of where to run tasks and how to use credits is completely in the user's hand." Believe the framing only if you make the choice explicitly. Most operators will not; they will leave it to the product default and inherit whatever plane that default lands on. The rest of this piece is about making that choice a rule you own.

2. The two axes that decide it, and why local became viable now

Two questions decide the plane, and neither is "how smart is the model."

Axis one — sensitivity. Does the context contain private files, mail, financials, customer data? If yes, that context should not cross the boundary unless you decide it may.

Axis two — difficulty. Is this a light step the local model handles, or the hardest reasoning in the task? Because local models are now good, and they are not uniformly good.

That second axis is not a hedge — it is the reason this is a split and not a winner. The mechanism that made local viable is worth understanding, because it tells you exactly where the ceiling is.

A 30B model on your laptop was not viable two years ago. It is now, for three stacked reasons, all visible in Meta's Muse Glimmer:

  • Distillation.** Muse Glimmer is "distilled from Muse Spark to run agents locally on consumer hardware" — a large flagship compressed into a ~29.6B dense model (including a ~1.8B perception encoder) trained for tool calls with precise schemas, multi-step reasoning, and recovery when a tool call fails. (Meta model card; Meta open-weight docs.)
  • Aggressive quantisation.** "4-bit dynamic compression (K-Quant), the model footprint drops to roughly 17 GB to 20 GB," inside a 24–32GB envelope with a measured 1.0% / 0.2% degradation. (InfoQ; model card.)
  • Speculative decoding.** A DFlash drafter proposes multi-token blocks the base model validates in parallel, "yielding up to a 3.1x increase in generation throughput." (InfoQ.)

Three optimisations collapse a capable-enough agentic model into a consumer envelope. But capability scales with footprint — which is why the same source shows the ceiling plainly. Muse Glimmer scores 0.5% on Terminal-Bench 4 and an agentic index of 8.5, with a -32.9 Omniscience index, and its own card says to check factual answers. (Model card.)

Read those two facts together and the design writes itself. Local handles light and private work. Local collapses on hard terminal and coding work. Perplexity keeps 15+ frontier models reachable precisely because local is not sufficient for the hardest reasoning. Local is the default for sensitivity, not for difficulty. Anyone who tells you the split is about cost or privacy alone has skipped the harder axis.

3. Local / hybrid / cloud on the dimensions that matter

Here is the same decision, laid out on the four dimensions this reader actually weighs. The comparison is not feature lists; it is where each plane wins and where it fails.

| | Local | Hybrid | Cloud escalation |

|---|---|---|---|

| What runs where | Model + harness + execution on device | Cloud plans/searches/reasons; local model processes private files | Frontier model handles the hard step |

| Hardware gate | 36GB+ Apple silicon recommended | Works from 24GB (32GB best results) | None — the cloud holds the model |

| Cost shape | Local tasks consume no Computer credits; cost moves to hardware + subscription tier | Mixed: cloud steps bill, local steps do not | Credits per step |

| Right call | Sensitive context the local model can handle | Private context that also needs fresh web or connected apps | The hardest reasoning, or an open-ended problem |

| Wrong call | Hard terminal/coding work (0.5% on Terminal-Bench 4) | Nothing sensitive that a local model handles fine — you paid for a division you did not need | Anything you would regret sending off-device |

Sources for the mechanics: Perplexity launch post and help centre for the plane definitions, memory thresholds and credits; model card for the local ceiling.

Two honest corrections to the launch framing, both from the vendor's own fine print.

The hardware gate is real, so check which plane you can reach. "Runs on your Mac" reads as your machine; the fine print needs 36GB+ for fully local, 24GB for hybrid, and less memory is not a listed supported config. (Launch post; help centre.) The shift is real and partial — it excludes the common 16GB laptop. On Windows and Linux, Perplexity's Portable Computer runs the model and agent on device and "reaches the cloud only with your permission," so the plane you can reach also depends on your platform, not just your memory. (Help centre.)

Cost is a shift, not a saving. "Local tasks do not consume Computer credits" is a genuine per-task saving. But the cost does not vanish — it moves into the hardware upgrade and the subscription tier. The honest framing is capex + tier against per-task cloud spend, not free inference. No source here nets those out for any individual operator.

4. The decision table — and the checklist the launch framing skips

The "Where should this agent run?" routing table. Ask the deciding question; the plane follows.

| Deciding question | Plane | Cost / risk note |

|---|---|---|

| Private or sensitive context, and the local model can handle it | Local | No credits; cost is hardware + tier. Watch the hardware gate. |

| Private context plus fresh web, current info, or connected apps | Hybrid | Cloud steps bill, local steps do not. The division is only worth it when the task genuinely needs both. |

| Hard reasoning, open-ended problem, hard terminal or coding work | Cloud escalation | You pay per step — and you authorize the boundary crossing. Check the privacy gate first. |

Then the second object, because the same move that keeps your data home changes what the agent is.

The privileged on-device agent checklist — five controls:

  • Scope its file and app access to the task.** Least privilege, not "connect any folder." The help centre advertises connecting any folder; that is the opposite of a scope.
  • Keep code and tool execution sandboxed.** Perplexity runs code/tool execution in isolated sandbox environments; if you run your own agent, the sandbox is yours to draw, and the isolation is not the part to skip.
  • Keep a consent-and-mask gate on anything that crosses the boundary.** Perplexity's privacy gate "can mask sensitive details, keep the step local, refuse the action, or ask for your consent" before protected information reaches the cloud. If your agent has no such gate, it has no boundary.
  • Know your hardware plane.** Local vs hybrid vs cloud-only is decided by memory and platform. Know which one your machine actually reaches before you trust a design that assumes a plane you cannot run.
  • Read back what it actually did.** An on-device agent that fails silently has no upstream watcher. The controls above are the vendor's own description, not an audited guarantee — the readback is yours, and it is the only one there is.

Two vendor mitigations worth naming, because they are the shape of a real control: Mac mini sessions are secured with two-factor authentication, and on-device authorization protects sensitive steps. (Help centre.)

5. The misunderstanding that trips everyone

The lazy reading of "fully local" is "private and cheap." Both halves are half-true, and the two halves are the two traps.

Trap one — "local is private" is a design claim, not a verified property. "Fully local" means your data does not go to the cloud. It does not mean the risk disappears. The same agent reads your Mail and Messages, plans tasks, and executes code on your machine. The risk surface moves from "who sees my data in the cloud" to "what can a privileged on-device actor do to my machine, and what did it actually do?" Perplexity's mitigations are the vendor's own description — no third-party audit confirms the local mode keeps all data on-device end to end. (Launch post; help centre.)

Trap two — "local is cheap" is a cost shift, not a cost deletion. Local steps cost no credits; the hardware and the tier cost money. And the local model is not free of failure: the vendor's own numbers put it at 0.5% on Terminal-Bench 4. (Model card.) A cheap decision that is wrong is not a saving.

And the trap underneath both: treating this as a model race. Every source here still routes the hardest reasoning to the cloud. The frontier is not being displaced. Local models are winning the default plane for sensitive and light work; the frontier keeps the hard steps. That is a split, and the split is the design.

Where you will get stuck

  • You will keep choosing a model instead of a plane**, and never ask which of local / hybrid / cloud a given task belongs on.
  • You will assume "fully local" means your machine**, and discover your 16GB laptop is not a supported config for the plane you designed around.
  • You will read "no credits" as "free"**, and miss the hardware and tier cost that replaced the per-task spend.
  • You will treat "local" as "safe"** and hand the agent file and app access you never scoped, on the theory that nothing is leaving the machine anyway.
  • You will skip the readback.** An on-device agent that fails silently has no upstream watcher — the failure you never see is the one nobody catches.

What to do first

Do not rebuild your stack today. Do one thing: make the routing explicit for one real task.

  • Take your most sensitive real task** — the one that touches private files or mail.
  • Ask the two axes**: is the context sensitive, and is the reasoning light or hard? Write the answer down.
  • Send it to the plane the table names** — local if sensitive and model-adequate, hybrid if it also needs fresh web, cloud only for the hard step.
  • Put a gate on the boundary.** If anything can cross, make it a decision you authorize, not a default.
  • Read back what the agent did** — files touched, actions taken, output produced. If you cannot read it back, you do not control it.

The compressed ending

Remember it in four beats:

  • Pick the plane, not the model.** Local for sensitive context the model can handle, hybrid for private-context-plus-fresh-web, cloud only for the hardest reasoning you explicitly pay for.
  • Local is the default for sensitivity, not for difficulty.** A 30B model on your laptop handles light and private work and is near-useless on hard terminal and coding tasks — which is why the split, not the model, is the design.
  • The risk moved; it did not shrink.** The on-device agent is a privileged actor that reads your mail and files and runs code — scope it, sandbox it, gate it, and read back what it did.
  • "Fully local" is a plane, not a promise.** Check your hardware can reach it, and treat the vendor's privacy line as a design claim until something independent verifies it.

The agent moved onto your machine. The question stopped being "who sees my data" and became "what can this thing do to my machine, and what did it actually do?" Route every task to the right plane, and keep the answer to the second question in your own hands.

---

Sources

  • Perplexity — Computer runs fully local on Mac (2026-10-20) — model + harness + execution on device; Hybrid vs local modes; escalate to cloud for current information, browser use and connected apps; "one of 15+ frontier models for advanced reasoning"; Qwen 3.6 / PPLX Pro local models; 36GB+ recommended; isolated sandbox for code/tool execution; local tasks don't consume credits.
  • Perplexity — X post and X follow-up — "The model and the agent both run on your Mac"; Pro/Max/Enterprise on supported Apple silicon, 36GB recommended.
  • Perplexity — What is Personal Computer? (help centre) — the hardware/local-mode table (24GB+ hybrid on Apple silicon; 32GB best results); downloadable local models (Gemma 4 E4B, Qwen3.6 35B-A3B, Perplexity model); privacy gate (mask / keep local / refuse / ask consent); on-device authorization; Mac mini 2FA; Portable Computer on Windows/Linux reaches the cloud only with permission.
  • Meta — Open-weight models docs and Muse Glimmer 30B model card — Apache-2.0; ~29.6B dense incl. ~1.8B perception encoder; distilled from Muse Spark; ~17–20GB at 4-bit K-Quant with 1.0%/0.2% degradation; DFlash ~3.1x throughput; 0.5% Terminal-Bench 4, agentic index 8.5, Omniscience -32.9; "runs locally without cloud infrastructure or network access."
  • InfoQ — Meta Open-Sources Muse Glimmer (2026-08-14) — distillation / quantisation / speculative-decoding mechanism; 17–20GB; up to 3.1x on Apple Silicon and RTX 5090.
  • Jetson AI Lab — Muse Glimmer 30B — official 17GB K-quant build designed for a 24GB envelope; companion perception-encoder and DFlash GGUF files.
  • Artificial Analysis — X post (2026-10-20) — Muse Spark Open 38.9 (highest US open-weights intelligence); Nemotron 3.5 Super VL 26.5 / 120B; Beam 1.0 30.3 / 501B.
  • Ornith AI — Ornith-1.5-122B-MLX — 122B MoE, MIT license, designed for single-GPU / single-DGX deployment, MLX variant.
  • DeepSeek-AI — DeepInfer — Apache-2.0; "the high-performance inference framework that powers DeepSeek's large-scale production services"; created 2026-10-16.

Precision notes. (a) "Fully local" is Perplexity's design description, not an independently verified property — no third-party audit confirms data stays on-device end to end. Treat the privacy line as a vendor claim. (b) The plane definitions, memory thresholds and credit mechanics are Perplexity's own, self-reported. (c) Model-card benchmarks (Muse Glimmer and peers) are vendor- or community-run and move with harness and quantisation — directional, not an independent ranking. (d) No published data measures adoption or realised savings: nothing here says what share of a typical operator's workload is genuinely local-viable, or what local mode actually saves net of hardware and tier. (e) The memory thresholds and specific model names are a late-2026 snapshot and will move within months; the durable part is the split, not the numbers. (f) The "local is the default for sensitivity, not for difficulty" framing and the two-axis routing rule are this piece's inference from the packet's sources, stated as an argument. (g) Two secondary URLs named in the packet — 9to5Mac and MacRumors — were rate-limited (HTTP 429) during drafting and could not be re-fetched here; every claim they supported is also carried by the primary Perplexity launch post and help centre above, so nothing in this draft rests on them alone.

---

X entryway list (from the approved angle)

The five distribution entryways named in the angle brief. Hooks are not yet written as posts — this names each post's type, the one claim or mechanism it carries, and whether it links.

  • Hook type: surprising proof.* On 2026-10-20 Perplexity shipped Computer fully local on Mac* — model, harness and task execution all on device, working across Notes, Mail, Messages and Numbers, with 15+ frontier models demoted to a consent-gated escalation and local tasks costing no credits. A shipped, dated product doing exactly the split this piece argues for — not a think-piece. → Links to article (the fact stands alone; the article supplies the routing rule that acts on it and the two-axis reason the split exists — the link is the deepening, not the reason the claim holds).
  • Hook type: mechanism.** Why local became viable now: distillation into a ~30B student, 4-bit K-Quant to ~17–20GB at ~1% degradation, and DFlash speculative decoding at ~3.1x throughput collapse a capable-enough agentic model into a 24–32GB consumer envelope — and the same source shows the ceiling (0.5% on Terminal-Bench 4), which is why the answer is a split, not a winner. → Links to article (self-contained mechanism; the article carries the two-axis rule and the plane-by-plane comparison it implies).
  • Hook type: workflow.** The routing rule in practice: classify each task on sensitivity × difficulty and send it to local (sensitive, model-adequate), hybrid (private context plus fresh web/connected apps), or cloud (hard reasoning you explicitly pay for) — the same decision Perplexity productized, which any operator can apply today regardless of vendor. → Links to article (the workflow is the actionable bit; the article is the why behind each axis and the decision table itself).
  • Hook type: risk.** The part the launch framing skips: the on-device agent reads your Mail, Messages and files and executes code. The risk does not vanish — it relocates from "the cloud sees it" to "a privileged actor can act on it." "Fully local" is a privacy design claim with no third-party audit, and the readback is yours. → Links to article (names the trap; the article turns it into the five-point privileged-agent checklist).
  • Hook type: result.** The defensible architecture an operator can state to a team or a security reviewer: private work stays local, the hard reasoning escalates to the frontier, and the boundary is a gate you control — instead of defaulting everything to the cloud. → Links to article (concrete before/after; the article grounds it in the shipped Perplexity architecture and the plane comparison).

Hook-type map: 1 = proof; 2 = mechanism; 3 = workflow; 4 = risk; 5 = result. All five link, and each link is a bonus — every post carries a claim that stands on its own. These are the five entryways the angle brief named; no additional entryway was invented, and no entryway repeats another's hook.