Perplexity Hybrid Compute: Sensitive Work Split Between Device and Cloud

What Hybrid Compute offers

The local model is a 27-billion-parameter Qwen 3.8 variant tuned by Perplexity, installed with a one-click download and no separate runtime to configure. Work handled locally uses no cloud credits. The privacy classifier that pseudonymises data before it is sent has been open-sourced, which means security teams can inspect how it works.

The feature has firm hardware requirements. It needs Apple silicon and at least 24 GB of unified memory, with 32 GB recommended. Macs with 8 or 16 GB cannot host it. The launch coverage describes no administrative controls for organisations, and it does not explain how the system decides when a step moves to the local model.

Where the design holds

Splitting work by sensitivity is the right architecture for most knowledge work. The cloud model brings breadth and current information; the local model handles the material that should never leave the device. Pseudonymising data before a cloud call is a sound control in its own right, because even when a step goes to the cloud, the provider sees placeholders in place of a customer's name or account number.

Opening the classifier is a meaningful choice. A privacy control that cannot be inspected asks the enterprise to trust a claim. A published classifier can be tested against the organisation's own data, which is how a security team should evaluate any control that stands between employees and an external service.

Where the enterprise still carries the load

The classifier is designed to recognise personal identifiers. Much of what an enterprise considers sensitive contains none. An unannounced acquisition target or a draft quarterly result can be described without a single name or account number, and a classifier trained on personal data will let it pass. Deciding what counts as sensitive is a policy decision rooted in the organisation's own classification scheme, and the launch offers no way to express that policy.

The hardware requirement narrows the audience. Many enterprise laptop fleets are standardised on configurations with 16 GB of memory, so the employees who could use Hybrid Compute may be a small subset of those who would want it. Local processing also moves sensitive work onto endpoints, so device encryption and loss procedures become part of the AI control environment.

The absence of administrative controls matters most for regulated firms. A compliance team will want to set which data classes must stay local, and to confirm that the local path is enforced instead of merely preferred. Until those controls exist, the feature is a well-designed personal tool more than an enterprise one.

Where it fits

Hybrid Compute suits individual professionals and small teams on capable Macs who handle personal data in their research and want it kept off the cloud. It is a reasonable pilot for an enterprise that wants to test the split-compute pattern on a limited group, with the security team reviewing the open classifier against its own data first. It fits poorly as a fleet-wide tool until organisations can define their own sensitivity rules and audit where each step was processed.

The direction is welcome, and it is likely to spread to other assistants. Enterprises considering it should keep sight of the question the launch leaves open. A CISO should ask who defines sensitive data in any split-compute tool, and whether the organisation can see where each step was processed. A tool that lets the enterprise answer both is one that can support outcomes that survive scrutiny.