Perplexity Personal Computer on Mac: Capable desktop AI agent that requires strict enterprise governance

86 steps, one stubborn Outlook folder, and a surprisingly helpful Mac agent

ZDNET ran Perplexity’s Mac app through five real-world tasks that required local file access, cloud logins, native app control, web automation and a voice workflow. One task, the reviewer reported, “took more than 30 minutes to complete and required 86 separate steps, ” yet the agent still produced a clear summary, an outcome the reviewer summed up bluntly: “I was quite impressed with Personal Computer. Frankly, I gave it some tasks that I didn’t think it could handle, and it completed them as I requested.”

At a glance

What it is: A desktop AI agent (Perplexity’s Personal Computer) that can read and write local files, control certain macOS apps, and access signed‑in cloud services via OAuth connectors.
Main risk: It requires powerful macOS entitlements (Accessibility, Screen & System Audio Recording, Full Disk Access) and uses a company‑managed browser (Comet) for logged‑in web automation, both of which raise governance and data‑handling questions.
Recommended first step: Test in a sandbox: connect a single throwaway folder, use test cloud accounts, pair your phone for 2FA, and watch the first run live.

What Personal Computer actually does (and what Perplexity says)

Perplexity’s Personal Computer runs inside the Perplexity Mac app and covers three areas: local files, native macOS apps, and signed‑in cloud services. Perplexity’s setup guide explains the architecture succinctly: “Comet is the agentic browser. Personal Computer hands web tasks to Comet so the agent can navigate logged‑in sites, fill forms, and pull info from across the web.” You can read that guidance on Perplexity’s setup page.

Local file access: The agent can search, read and write files where you permit it.
App control: It can interact with native apps (examples include Mail, Messages, Notes and Calendar, depending on the environment and permissions granted).
OAuth connectors: The app supports connectors for cloud services (Perplexity lists Google Workspace and Microsoft services among examples); reviewers also tested OneDrive, Google Drive, Box and Dropbox integrations.

Perplexity frames this as explicit control: “Point the agent at the folders it can touch…and sign into the services it should know about. It only sees what you connect.” That is the company’s claim. Evaluate it against your security and privacy requirements before trusting sensitive data to the agent.

What the ZDNET hands‑on test showed

The reviewer installed the Perplexity Mac app (Personal Computer was reported by the reviewer as appearing for Perplexity Max subscribers and reportedly visible to Pro/Enterprise as well), granted system permissions, added connectors, and assigned five tasks of rising complexity. The following tasks were described in the hands‑on report; Task 2 was not detailed in the notes available for this summary, so the account below focuses on the four tasks the reviewer documented.

Task 1, Italian practice tool: The agent built a simple language practice tool; the reviewer reported the job took about 15 minutes to complete.
Task 3, Translate an article and create audio: The reviewer used Microsoft OneDrive as the source file, engaged Voice Mode for spoken interaction, and encountered a visibility glitch: the agent said it couldn’t “see” an attached document until Documents‑folder permission was explicitly granted.
Task 4, Invoices → Excel → Box: Using Google Drive as the source, Perplexity scanned an Invoices folder, extracted client names and amounts into an Excel sheet, added a total row, and copied the spreadsheet to a Business folder on Box. The resulting file was surfaced inline in the conversation.
Task 5, Scan and summarize Outlook emails: As noted above, the reviewer reported this one “took more than 30 minutes to complete and required 86 separate steps.” The agent initially failed to locate the specified Outlook folder and instead searched all folders; despite that, it found the target emails, produced a clean summary, and saved a Word document to OneDrive.

“I was quite impressed with Personal Computer. Frankly, I gave it some tasks that I didn’t think it could handle, and it completed them as I requested.”, ZDNET reviewer

Permissions, Comet, and what they mean for security

Perplexity’s setup and the reviewer’s experience highlight three technical realities you can’t ignore:

macOS entitlements: The app requests Accessibility (to simulate clicks and typing), Screen & System Audio Recording (to capture and view the screen and audio context), and Full Disk Access (to read files outside sandboxed folders). These are powerful permissions. With them the agent can simulate user input and access broad swaths of local data, including Mail attachments and Desktop files.
Comet is required for logged‑in web automation: Perplexity routes interactive web tasks through its Comet browser so the agent can log in, fill forms and click buttons. That centralizes credential and session handling in a Perplexity‑managed browser, which simplifies automation but concentrates trust and operational questions about session storage and token handling.
Phone pairing for approvals: Perplexity’s documentation recommends pairing a phone to handle 2FA prompts and approve sensitive actions, a deliberate mitigation to reduce unattended approvals during automated runs.

Together these choices reduce some friction for automation while increasing the surface area security teams must assess. For organizations, entitlements such as Full Disk Access and Accessibility typically demand MDM/EDR review, scoped policies, and audit controls before broad deployment.

Practical checklist before you grant entitlements

Start with a single test folder and a throwaway cloud account, verify read and write behavior there before expanding scope.
Pair your phone and confirm 2FA flows so tasks requiring approvals don’t stall.
Ask IT to vet macOS entitlements and document accepted mitigations (MDM profiles, EDR rules, DLP exclusions).
Observe and record the first production‑like run; capture timestamps and action logs for auditing.
Limit connector scopes where possible (use least privilege OAuth tokens or test accounts).

Where this approach breaks, and why those failures matter

The ZDNET reviewer’s hiccups, an attached file the agent “couldn’t ‘see’” until Documents access was granted and the Outlook‑folder lookup that failed and fell back to scanning all folders, illustrate common failure modes in end‑to‑end automation:

Agents rely on explicit scoping. If a folder isn’t connected or its name and path differ, the agent won’t find expected resources.
Mailbox and app metadata vary across clients and server APIs. An agent that expects a specific folder path can be tripped up by server‑side folder IDs or a nonstandard client layout.
Long, multi‑step workflows can succeed yet be slow and opaque. The 86‑step task is a reminder that agents can generate complex action trails that need monitoring, retention controls, and clear auditing to be trustworthy in enterprise settings.

Suggested follow-up tests, prioritized

Must‑do: Reproduce the upload visibility issue, attach a file via the app prompt vs. granting Documents access first; repeat the flow three times to check reproducibility.
Must‑do: Test Outlook folder resolution, create a uniquely named folder and three test emails; verify whether the agent finds it directly or falls back to full mailbox search.
Important: Run a Comet session with a test account to observe how cookies, sessions and OAuth tokens are stored and whether those sessions are isolated from other browsers.
Nice‑to‑have: Time and count steps for representative tasks (capture timestamps per action and API call) to quantify performance and variance across runs.

Governance: four concrete mitigations enterprises should demand

Scoped enterprise access: Require SSO and scoped OAuth connectors (avoid broad, persistent service tokens; prefer short‑lived tokens and per‑user consent flows).
MDM/EDR controls: Gate granting of Accessibility and Full Disk Access via MDM policies; restrict which endpoints can run Personal Computer and enforce EDR monitoring.
Audit and SIEM integration: Insist on exportable action logs and per‑action telemetry that can be ingested by your SIEM for forensic review.
Data handling guarantees: Ask the vendor for explicit documentation about where data is processed (local vs. remote), encryption in transit and at rest, and retention policies for any files or chat histories created by the agent.

Questions you’ll want answered before rollout

Does the vendor provide admin controls to centrally enable or disable Personal Computer for users?
Where does LLM inference occur, on the device or in the cloud, and what gets transmitted off‑device during a task?
Are action logs available to enterprise customers, and can they be exported to a SIEM?
How does Comet store and isolate sessions, cookies and OAuth tokens?

Key questions, short, honest answers

Can Perplexity run agentic tasks on a Mac?

Yes. Perplexity’s Personal Computer can access local files, interact with certain native macOS apps, and operate across signed‑in cloud services; web interactions that require logged‑in sessions are routed to the Comet browser (Perplexity documentation).
How reliable is it?

Capable for many real tasks but not flawless, ZDNET’s hands‑on review reported mostly successful runs with notable hiccups (e.g., an upload visibility issue and an Outlook‑folder resolution problem) that are typical of early desktop automation.
What macOS permissions does it ask for?

The app requests Accessibility, Screen & System Audio Recording, and Full Disk Access, entitlements that allow the agent to simulate input, capture and view the screen and audio context, and read files outside sandboxed folders (Perplexity documentation).
Is data processed locally only?

Perplexity’s setup guide emphasizes explicit folder and connector scoping, but public documentation does not fully disclose whether all inference or file content remains local; verify data‑handling, encryption and retention with Perplexity before using with sensitive information.
Should enterprises deploy this widely today?

Not without governance. Permit pilot deployments only with SSO, scoped OAuth, MDM/EDR controls, exported audit logs, and a clear vendor statement on data handling and retention.

Questions to ask Perplexity before you pilot

Does Personal Computer support enterprise admin controls (central enable/disable, SSO, SCIM integration)?
Where does Perplexity perform LLM inference, and what data is transmitted off device during tasks?
Are detailed, per‑action logs available to enterprise customers and exportable to a SIEM?
How does Comet manage session isolation and credential storage for logged‑in web automation?

Bottom line

Perplexity’s Personal Computer shows what modern AI agents can do on the desktop: stitch together local files, cloud connectors and web interactions to finish multi‑step work. The ZDNET reviewer’s experiments, including the 86‑step, 30+ minute email scan, show the approach can succeed even when brittle. That capability is valuable for business automation, but it requires deliberate controls: scoped access, MDM gating of macOS entitlements, SIEMable logs, and clear vendor guarantees about data handling. If you’re curious, run a tightly scoped pilot, require phone pairing for approvals, and insist on the governance that makes this convenience safe.

“This one took more than 30 minutes to complete and required 86 separate steps.”, ZDNET reviewer

Perplexity setup documentation: https://www.perplexity.ai/personal-computer-setup