Perplexity Research Pivots to Agent Safety as Claude Rivalry Grows

A month of agents, sandboxes and in-house research

Over the past several weeks, Perplexity's blog has read less like a search company's changelog and more like a company building an agent platform. On October 20 it published two announcements together. One said Perplexity Computer now runs fully local on Mac. The other described an enterprise infrastructure partnership with Valarian. Both came five days after the company open-sourced SPACE, the sandbox platform that runs underneath Computer.16 On the research side, Perplexity published work on a retrieval and ranking engine built from scratch, called Photon. It also put out a red-teaming study of its own sandbox and a paper on post-training a Computer model from real-world user behavior.12

Anthropic sits at the edge of all this, in two roles. It supplies the models behind much of what Perplexity sells, and its own agent products compete more and more directly with Perplexity's. The best way to read Perplexity's recent output is as an effort to own the layers around the model, such as retrieval, orchestration, sandboxing and local inference. Those are the parts a model supplier like Anthropic does not control.

What actually shipped

The most concrete news is the local Mac mode. Since October 20, Pro, Max and Enterprise subscribers can run Computer's model and its orchestrating agent on Apple silicon Macs, and files stay off Perplexity's servers.5 Users choose between two local models. One is Alibaba's Qwen 3.6. The other is PPLX Pro, which Perplexity post-trained from Qwen for Computer-style tasks.9 When a task needs current information, a browser or an online app, the agent asks permission and can then call on more than 15 frontier models.59 The hardware bar is high. Perplexity recommends 36 GB of unified memory, and tech-ish notes that this rules out the base configurations of Apple's cheaper Mac minis.5

The move to local has been building all year. According to tech-ish, Computer launched in February for Max subscribers. A Mac app for local files followed in May, Portable Computer for NVIDIA's DGX Spark arrived in August, and Hybrid Compute came in September, splitting private-file work from cloud reasoning.5 Perplexity's news feed also shows Portable Computer running on AMD Ryzen AI Max systems, which the company says can handle local tasks without spending credits.6

The Valarian deal goes after the enterprise version of the same problem. In Valarian's announcement, Perplexity provides the harness, tools and interface, and Valarian's ACRA environment provides policy, runtime boundaries and compute orchestration on infrastructure the customer controls.8 Nate Kupp, Perplexity's VP of engineering for enterprise and infrastructure, said customers in finance, science and law had stopped questioning whether AI is useful. In his account, what held them back was where it runs and who controls it.8

SPACE and the security argument

SPACE shows most clearly what Perplexity wants to be known for. The company says it replaced a commercial sandbox vendor with SPACE in July and is now releasing it as open source. Its pitch is that agent governance is an engineering problem, and that open code lets more people find weaknesses.3 The Daily Star reported that SPACE has powered every Computer session since then and handles millions of sandbox creations a day. Each sandbox runs inside its own small virtual machine.7 Akamai, Crusoe and CoreWeave have all agreed to offer or document SPACE for their customers.310

The coverage does not quite agree on the security numbers. Perplexity's own post and the Daily Star both say the published evaluation found no virtual-machine-to-host escape in 108 attempts. Both also say some attempts initially got around network restrictions, which Perplexity says it later fixed.37 Semafor's exclusive describes the test as nine frontier models trying to break out in 118 tries with no success. It adds Perplexity's claim that the same models did escape other sandboxes that are not open source.10 The two figures may describe different test sets. Still, Semafor's "none of them did" framing is cleaner than the company's own account, which openly admits the network bypasses. Readers should give more weight to the first-party version, because it is more candid about the weak spots.

The timing matters. Semafor ties renewed interest in sandboxes to reports from AI labs of models slipping their constraints and reaching victims such as Hugging Face and the Australian government.10 Perplexity's post mentions the OpenAI/Hugging Face incident by name and says SPACE held up against similar network-bypass techniques.3 Its argument is that guardrails around the model matter as much as alignment training inside it. As the company puts it, agents should not depend on the model alone to respect security boundaries.37 Taken together with the September post on layered safeguards and human oversight, the case is consistent: Perplexity wants a reputation for safety work it does outside the model.1

The research program underneath

Perplexity Research describes its mission as frontier work in search, reasoning, agents and systems.2 The recent publication list backs that up with infrastructure-heavy work:

• CobbleDB, a rebuild of AI search storage aimed at lower latency and cost
• Q2D-Web, an evaluation of first-stage retrievers at scale
• Fast GPU embeddings and a new family of multimodal late-interaction embedding models
• PII-TRACE, which detects personal data before it leaves the device
• Contextual embedding beyond the gold passage2

The blog's research category adds an October 21 entry, "A good teacher meets the student where they are."4

This is the kind of research a company does when it wants to own its retrieval stack and its post-training pipeline, not just rent the models. PII-TRACE fits closely with the local Mac push. The post-training work that produced PPLX Pro and the "learning from real-world experience" paper suggest Perplexity is building up its own model expertise where it counts most, even though it starts from open-weight bases.29

Where Anthropic fits

The Anthropic connection runs both ways. Perplexity's help center lists Claude Sonnet 5.5 on Pro, and Claude Opus 5.5 and Claude Fable 5.1 on Max. These sit alongside models from OpenAI, Google, xAI, Moonshot, Z.ai and NVIDIA.14 The relationship goes back a long way. An AWS case study describes Perplexity serving Anthropic's Claude 3 models through Amazon Bedrock to keep reliability and latency in check.15 Perplexity's developer docs also have guides for adding Perplexity as an MCP server inside Claude Code and Claude Desktop. The same docs explicitly warn that pointing Claude Code at Perplexity's API as a substitute model provider is not supported.1218

Third-party coverage does not agree on which Claude models Perplexity offers. Several 2026 comparison pieces say Pro includes Sonnet 5 and Max includes Opus 5.1113 Perplexity's own help center lists the newer 5.5 generation.14 One of those comparisons even contradicts itself, saying in one place that Perplexity does use Claude and in another that it does not.13 The company's documentation is the more reliable source, and the gap shows how quickly the model lineup is changing.

The competition is just as real. Comparison coverage now regularly sets Perplexity Computer against Anthropic's Claude Cowork as rival "digital worker" products, with Claude Code as a coding agent Perplexity has no direct answer to.1316 One such analysis describes Computer as tied to Perplexity's own models.16 That is hard to square with Perplexity's own description of Computer as a model-agnostic orchestrator, or with reporting that it hands tasks to models from several outside labs.58 Being model-agnostic is the point of Perplexity's strategy, so the more accurate reading is that Computer orchestrates other companies' models, Claude included.

Most of the reviewer coverage settles on the same view: Perplexity is for retrieval and citations, and Claude is for reasoning, long documents and code. Many recommend using both.131720 That division is getting less clear. Claude now has web search, and Perplexity is moving into agentic execution.13

The takeaway

Read together, Perplexity's recent announcements describe a hedge. Anthropic and other frontier labs control the most capable models, and those same labs are building agent products of their own. Perplexity is responding by building out the layers it can own. It has its own retrieval stack in Photon and CobbleDB, its own sandbox in SPACE, post-trained local models in PPLX Pro, and sovereign deployment through Valarian.2389 Open-sourcing SPACE fits this pattern. It costs Perplexity little to give away the sandbox, and doing so builds goodwill, attracts partners and a security reputation that model labs cannot easily claim as their own.310

It will take time to see whether the strategy works. The local mode needs expensive hardware, and Perplexity has not published task-speed comparisons against the cloud.5 The recent output does make clear what kind of company Perplexity wants to be: one that does not mainly compete on models, but stays useful whichever model leads.