The AI agent runs on your Mac now. It still reads your mail

What's new

On October 20, 2026, Perplexity said its Computer agent can now run fully locally on a Mac. According to MacRumors, The Verge and 9to5Mac, the local mode runs Qwen 3.6 or PPLX Pro, a post-trained version of Qwen, on Apple silicon, and Perplexity recommends 36GB of memory or more. The model, task planning, reasoning and file processing happen on the device. Code and tool execution run in isolated sandboxes. With permission, it can work with Notes, Messages, Mail, Keynote and Numbers.

9to5Mac describes the kind of job Perplexity has in mind: go through recent messages and emails, find the deadlines, and build an action list in Notes. That's a useful job. It's also a job that involves reading every message in your inbox.

So the question small teams are asking is reasonable: if it runs on my Mac, is it safe to let it near the mail? Local is a real improvement. It's also easy to read more into it than it promises. Here are the four assumptions we hear most, and what's actually true.

Myth: local means private

Local means your data doesn't have to leave the machine. That's a genuine privacy gain, and for some teams it's the difference between using an agent and not.

But private from whom? The agent itself still reads everything you let it read. If you give it Mail, it sees client contracts, password reset links, payroll questions and the email from your lawyer, all at once. Nothing about running on-device changes what's in that inbox or who else might be affected by what the agent does with it.

Local answers the question of where the work happens. It doesn't answer what the agent is allowed to touch.

Myth: local means offline, always

The local mode can run tasks without an internet connection. But the reports are clear that it isn't sealed off. When a task needs current information, browser use or cloud-connected apps, the user can authorize cloud access and decide when to spend credits. MacRumors notes there's also an option to call on more than 15 frontier models. Perplexity's earlier Hybrid Compute mode, which works on Macs with as little as 24GB, splits work between cloud and local models by design.

None of that is hidden, and the authorization step is a sensible design. But it moves the decision to the person at the keyboard, in the moment, with a task half-done. If someone on your team clicks yes to get the task finished, the data may go to the cloud after all. That's the moment your policy has to cover, not the setting screen. A simple rule helps: if the task involves customer or staff data, don't authorize cloud access mid-task. Stop, and ask the person who owns that data.

Myth: the sandbox keeps it safe

Code and tool execution run in isolated sandbox environments, which is good practice and limits what a bad command can do to the machine.

A sandbox protects the computer. It doesn't protect the decision. An agent working through email can still misread a request, act on an instruction buried in a message from a stranger, draft a reply that commits you to something or move a file it shouldn't. The question isn't whether the agent can break the Mac. It's whether it can do something a person on your team wouldn't have done.

The instruction-in-a-message problem deserves a sentence of its own. Email is the one place where strangers can put text in front of your agent without asking. A careful person reads a strange request and ignores it. An agent may treat it as part of the task. Running locally doesn't change that, because the risk comes from what the agent reads, not where it runs. It's one more reason to keep sending, deleting and paying out of reach until you've watched how it behaves.

Myth: it's a personal tool, so it's a personal choice

Local mode is available to Perplexity's Pro, Max and Enterprise subscribers. Plenty of people will turn it on with a personal subscription on a work laptop, the same way they started using chat assistants.

On a work machine, the inbox isn't only theirs. It holds customer data, supplier terms and conversations with people who never agreed to an agent reading them. That makes it a team decision. If you don't have a written policy for AI tools yet, start with the team you actually have. If you do, check it covers agents that act, not just assistants that answer.

The rules worth writing down

A short list goes further than a long one. For a local agent on work machines, we'd write down five things:

1. Which apps it may open. Notes and a project folder are a different risk from Mail and Messages. Start narrow.
2. Who approves cloud access. Decide whether staff may authorize it themselves, and for which kinds of task.
3. What it may send or change. Drafting is easy to review. Sending, deleting and moving things are where mistakes become visible to customers.
4. What it should never read. Folders with HR, legal or payment details may be better kept out entirely.
5. Who to tell when it goes wrong. A named person, and a plain way to report a mistake without blame.

Then look again in a month, once you know what people actually use it for. You'll probably find the real uses are narrower than you expected: a weekly deadline list, meeting notes turned into tasks, a first draft of a reply. Those are easy to allow. The few that need wider access are easier to judge once you can see them.

One more check that's easy to skip: the hardware. Perplexity recommends 36GB of memory or more for the local mode. If your team's laptops have less, people may end up on the hybrid or cloud options without thinking of it as a different choice. Your rules should say which modes are allowed, not just which product.

Our AI applications and agents work starts with these questions before any agent goes near customer data. If you want help setting the rules for your team, talk to us.

Related work: Sutton Place.