SovereignAI

Blog · Launch week, part 2 of 3 · August 25, 2026

Local is solved. Ownership isn't.

In one August week, Perplexity and NVIDIA shipped a local-first agent, a Berkeley lab shipped an engine that runs 120B-class models on a gaming GPU, two of the best open models of the year dropped their weights, and two benchmark sites launched to help you choose between all of it. Here is what that week means — and what none of it says.

By the SovereignAI team at Unify Dynamics · about nine minutes · every claim below links to its source at the end

The week, in six releases

What they all agree on

Inference has come home. Not "will come home" — the model that runs on the machine under your desk is now good enough for most of the work people actually do, and the economics have flipped: a token you generate locally costs nothing at the margin. Perplexity's own numbers make the case better than we could. On their coding benchmark the local model alone scores 59.6% for free; letting a frontier model advise on the hard steps lifts that to 73.0% at about 42 cents a task; the frontier model alone scores 82.4% at 65 cents. The gap is real, but so is the price, and the price is now something you choose per step rather than per subscription.

That is the tell. When a company whose business is an answer engine in the cloud ships a product where the cloud is the exception you approve, the argument about where computation should run is over. The cloud has become what it should have been all along: a specialist you consult, not a landlord you rent from.

The benchmark sites are the other half of the same signal. local.ai's tagline is the most honest sentence written about this market this year: "Running AI locally is easy now. Choosing what to run is not." When the hard problem moves from can I to which one, a category has matured.

What none of them say

"Local" describes where a computation runs. "Sovereign" describes who holds the result. Those are different words because they are different things, and the week's announcements are eloquent about the first and silent about the second.

We keep a public ledger of our own product's claims, and we propose the same three questions for any product that calls itself private:

  1. Can I read every line that runs?
  2. Can I take everything out — verified, in a documented format — and leave?
  3. When something isn't private, does the product tell me at that moment?

Run the week through them. Portable Computer answers the third question better than anyone has, and we will come back to that. On the first two it is quiet: the harness is closed, a Perplexity subscription and account are required, the Gmail, Drive, Slack and GitHub connectors sign in on your behalf and nothing says where those credentials live, and nothing in the launch material says where your memory lives, how you export it, or what deletion means. The benchmarks measure tokens per second on machines that cost more than most people's cars — useful, and beside the point for the laptop you already own.

None of this is a criticism of the engineering, which is excellent. It is an observation about what the industry is optimizing for. A local model attached to a cloud memory, behind a login, is a better-ventilated cage. The moat was never the model. The moat is the memory — the accumulated record of what you asked, decided, and were told — and the week that solved local inference did not move that moat one inch.

Where they are right, and we were behind

Credit where it is owed. Perplexity's per-step disclosure is the right instinct executed well: before anything leaves the machine, you see what would leave, and you say yes or no. We have disclosed which model answers and whether it is local since the first release. They show the bytes. That is better, and we were behind.

So we built it (the deep dive takes it apart). As of today's build, before any request goes to a remote provider, SovereignAI shows you the customs declaration: the system prompt, the memories it is about to inject, the document excerpts it retrieved, the prior messages, and your new one — with sizes — and waits. Every answer that came back from a remote model carries a receipt of how much left and to which host. Local models never gate, because nothing leaves.

One deliberate difference: there is no PII classifier in front of that dialog. A classifier is one more model reading your data and making a judgment you cannot audit. You can read the bytes yourself; that is the whole point of showing them.

What we are doing this week

The shelf is where a product like ours stays honest, so the shelf got the work.

Why it matters

Our thesis is that you are the most fragmented database on earth — every service holds a shard of you, and the joins between the shards are where your life actually is. The reassembled whole is the most sensitive dataset that could exist about a person, which is why it is only safe on hardware you control, in formats you can walk away with.

This week made the first half of that easy. The models are good, the engines are clever, and the hardware you already own is enough. What it did not do is settle the second half, and the second half is the part that decides whether "local-first" becomes a property you own or a feature you rent. If the industry stops at inference — local model, cloud memory, vendor login — it will have rebuilt the last decade's lock-in with better latency.

The honest version of local-first has to answer all three questions, and it has to answer them about itself first. So, for the record, the parts of SovereignAI that are not sovereign yet:

The database is not encrypted at rest; the honest answer today is full-disk encryption. The model layer is borrowed — even open weights are someone else's artifact, trained on data nobody can audit. A rented GPU is tenancy, and we print that before you provision. An unknown is reported as unknown, never rounded up to a feature.

Counterintuitively, the ability to leave is the strongest reason to trust a product like this. That has not changed this week. It just got a better week of company.

Your models. Your memory. Your machine.

The open trial is one Docker command — the real product, no account. The ledger lists what we cannot claim.

Run it now

Sources