“I would not expect either the agents or their users to be particularly happy if enterprises solve the security problem simply by denying network access. For many valuable use cases, connectivity is the point,” Wilkes said. “A proprietary trading firm, for example, may want confidential models and positions processed locally while still consuming current market data, SEC filings, news or research feeds.”
And, Mahapatra noted, although the built-in controls will not prevent unauthorized cloud escalation, “the reason is structural rather than a knock on Perplexity’s engineering. The gate is a permission prompt, which is consent, not control. It depends on a probabilistic model correctly classifying sensitive content and correctly scoping an escalation payload, and on a user judging a request they cannot fully inspect. Both fail adversarially.”
He pointed out that, with Gmail, Drive, Slack, and GitHub connectors on a device that also holds an authorized cloud path, “this is the same connector-plus-egress combination behind every Copilot exfiltration chain published this year. What would satisfy an enterprise security review is network-layer, not application-layer, and it does not exist in the product.”
