Local-first is a capability argument, not a privacy one

The usual case for on-device AI is privacy. It is a good case, but it undersells the point, because it frames local processing as a cost you accept for safety.

The stronger argument is that an agent is only as useful as the context it can see, and that people are rationally unwilling to give a cloud service the context that would make it genuinely useful.

The withholding is rational

You do not paste the contract. You do not connect the bank statements. You do not point it at the folder with everything in it.

This is not irrational caution, and it is not a failure of user education. It is a correct reading of the situation. Uploading a document to a service creates a copy you no longer control, subject to that vendor’s retention policy, that vendor’s breach history, that vendor’s response to a subpoena, and whatever their terms permit them to train on next year. For a holiday photo the calculus is easy. For a term sheet it is not.

So people do the sensible thing: they use the assistant for work where the context is cheap to expose. Summarise this article. Draft this email. Explain this error message. And the assistant becomes very good at exactly the class of task where it has the least leverage, because those are the tasks you could already do yourself.

What gets lost

The gap between the two modes is larger than it looks, because the tasks worth automating are almost all context-heavy.

“Draft a reply to this email” is a text transformation. “Draft a reply to this email, given the three previous threads with this person, the contract we signed with them in March, and the fact that the deadline moved last week” is a different task entirely, and the second one is the one worth having.

The same holds across the board. Reconciling statements requires the statements. Reviewing a change requires the repository. Preparing for a meeting requires the calendar, the last set of notes, and the document nobody has opened yet. In every case the useful version needs the material you were unwilling to upload.

An assistant restricted to what you are comfortable pasting is not a weaker version of the useful thing. It is a different and much smaller thing, and no amount of model capability fixes it. A frontier model with no access to your situation is a very articulate stranger.

Removing the reason to hold back

Running the model on hardware you own changes the calculation rather than the comfort level. There is no upload, so there is no copy elsewhere, so there is no retention policy to read and no breach to be exposed by. The question “should I give it this?” stops being a risk assessment and becomes a question about whether the context is relevant.

That is the actual unlock. Not that your data is safer, though it is, but that the set of tasks you are willing to delegate expands to include the ones that were worth delegating.

It is worth being precise about what this does and does not cover. Local inference means the model runs on your processor and the prompt does not leave the machine. It does not mean the machine is uninteresting to an attacker, that local files are encrypted at rest by magic, or that a service you deliberately connect will not receive what you send it. Those remain your problems, and they are ordinary computer-security problems with ordinary answers.

The trade, stated honestly

A model that fits on a laptop is not a frontier model. That is a real cost and we are not going to pretend otherwise.

But the comparison people reach for, small local model against large hosted model, is the wrong one, because it holds context constant and it never is. The realistic comparison is a small model with access to everything against a large model with access to whatever you were willing to paste into a text box.

For context-light reasoning the hosted model wins, often by a lot. For the context-heavy work that made you want an assistant in the first place, having the material tends to matter more than having the larger model. Knowing what is in the document beats being smarter about a document you have not read.

Neither of these is a general law, which is why the sensible architecture keeps both available and makes the routing explicit. Local by default, because that is where the context is. Hosted when a specific task genuinely needs the extra capability, with the consequence, that this request does leave the device, stated rather than buried.

Why this framing matters

If local-first is a privacy feature, it competes with convenience, and convenience usually wins. It becomes the option chosen by people with unusual threat models, and everyone else accepts the trade.

If local-first is a capability feature, the argument is different: this is the configuration in which the assistant can actually see your situation, and therefore the configuration in which it does the work you wanted done.

That is not a cost you accept for safety. It is the thing that makes the capability real.