Perplexity’s Personal Computer lands on Windows: what an AI agent that touches your files means for your SMB

On July 28, 2026, Perplexity released the Windows version of its Personal Computer agent, first opened to Mac subscribers on April 16, 2026 and to all Mac users on May 8. On Windows, the agent installs directly on the machine, reads local files, and can operate Excel, Word, PowerPoint, Outlook and OneDrive, routing each task across more than 20 underlying models depending on what it requires. Perplexity built in several safeguards: explicit approval is required before any sensitive or hard-to-reverse action — sending an email, deleting a file, acting remotely from another device — every session generates a full audit trail, file operations run inside a sandboxed environment, and a kill switch lets a user halt the agent instantly. The company also states that customer data is not used to train its models.

What actually changes

This launch is not an isolated technical novelty — Anthropic and OpenAI have offered computer-operating agents for months. What changes is distribution: Personal Computer is no longer confined to a managed enterprise environment, it is now a direct download onto the world’s most widely used operating system. Any employee with a Windows laptop can now install, in a few minutes and without telling management or IT, an agent that reads their local files and can act inside their work inbox.

What it means for your SMB

For an SMB owner, the risk is not the tool itself — the safeguards Perplexity describes (approval steps, sandboxing, audit trail) are exactly what a properly supervised AI agent should have. The risk is what falls outside those safeguards once the tool is in an employee’s hands on a work machine: which shared folders the agent can reach, what customer data or contracts pass through its logs, and who in the company would even see an alert if something went wrong. A study published in April 2026 by researchers at the University of Wisconsin–Madison, the University of Southern California and McGill University — The Blind Spot of Agent Safety — tested several computer-operating agents against instructions that look harmless but produce a dangerous outcome when carried out literally: the attack success rate exceeded 90% for most agents tested, and reached 73% for the most cautious model in the sample — a figure that climbed to 92.7% once the agent operated inside a multi-agent chain. A consumer agent installed without supervision on a work machine inherits that same fragility.

• →Decide now, before an employee decides for you, whether Personal Computer and comparable agents (Claude, ChatGPT) are allowed on work machines, and in what form — an enterprise version with centralized audit logs, or an outright freeze pending evaluation.
• →If a business agent already handles a sensitive process for you — sorting email, invoice follow-up, customer support — check that no consumer agent installed in parallel can touch the same folders or inbox without your knowledge.
• →For any agent able to act on a file or send an email on your behalf, require the three minimum guarantees Perplexity itself claims: human approval before an irreversible action, a reviewable audit trail, and an instant stop switch.
• →Communicate one simple rule to the whole team rather than discovering usage after the fact: which AI tools are allowed on company hardware, and which folders they are never allowed to touch.

That is exactly the discipline a well-designed operations watchdog agent applies: it monitors, it proposes, it alerts — but it never acts alone on a sensitive system without human sign-off. A consumer agent installed without a framework on a work machine has neither that discipline nor that traceability by default — it is up to the business to impose it, before the tool imposes itself.