Perplexity bills nothing for local work, which makes the escalation prompt the whole product

The billing meter and the security boundary are the same event. Perplexity charges only when the system is explicitly told to move compute to the cloud for more advanced research and reasoning ^[8], so escalation is the revenue moment. It is also the moment several of the consultants quoted by Computerworld say has not been explained: users may click through an approval pop-up the way they click through terms and conditions, or hidden instructions could push a task outward without the user knowing ^[2]. A meter that runs only on escalation does not reward making escalation harder.

Justin Greis of Acceligence put the gap in governance terms, arguing that local-first should not be confused with local-only and that an enterprise needs the ability to say "you are not permitted to ask" ^[13]. Mike Wilkes of Aikido Security described the blunt fix, cutting external network access, and doubted anyone would accept it, since for many valuable use cases connectivity is the point ^[14]. Perplexity's own example concedes as much: a term sheet stays local while the system fetches market comps from outside ^[9], and the connectors reach Google Drive, Gmail, Slack and GitHub ^[1].

Free local inference still has a bill, just in a different column. Flavio Villanustre, CISO at LexisNexis Risk Solutions Group, put the floor at a local GPU with at least 24GB of VRAM and said the offering requires an initial investment in specialised hardware even if it lowers ongoing expenses ^[12]. Nader Henein of Gartner noted that the announced models already run on high-end laptops with off-the-shelf GPUs, and that without a published price it is hard to get excited ^[11]. Zero for local work, an unpublished software price, and a mandatory GPU purchase do not add up to a cost per task anyone outside the company can compute ^[16].

What is actually new here is narrower than the pitch and more interesting. Aman Mahapatra of Tribeca Softtech said running a model locally has been table stakes for two years, and that the change is running the whole agentic control plane on device, so the decision about whether a task needs the cloud is itself made locally by a model post-trained to keep work local ^[10]. That matches what ships: orchestrator, planner, tool router, scheduler, durable task queue and local search index all on device ^[6]. The weights are not the moat. The router is, and today it runs on Linux only, with Windows promised later ^[7].