Perplexity testing New Gmail triggers that could wake AI when email arrives

Why it matters

Event triggers could replace slow, credit-consuming inbox polling with immediate runs. They also let untrusted email initiate an agent workflow, raising the stakes for approvals and prompt-injection defenses.

Perplexity is building event-driven automations that can start a Computer workflow when a matching email reaches Gmail, moving its AI agent beyond the hourly inbox checks available in the released product.

RuntimeWire reviewed Perplexity's official desktop package, v26.9.4, build 72244, downloaded on September 22nd. A workflow interface inside the package includes a section labeled "Run automatically" and an option to subscribe the workflow to Gmail events.

The clearest supported event is gmail.message_received, presented to users as "On new email." The interface offers optional filters for the sender, recipient, Cc field, subject, body, attachments and Gmail label. It tells users: "All filters are optional. Leave blank to fire on every event."

The implementation is controlled by a feature flag named computer-workflow-trigger-events. Production configuration retrieved on September 22nd disabled the flag by default and enabled it only for an extremely narrow internal allowlist, indicating that Perplexity is testing the feature rather than releasing it broadly.

From hourly checks to inbox events

Perplexity's released automation system remains based on schedules. Its Scheduled Tasks documentation, last modified on September 21st, gives users the example: "Check my Gmail every hour for replies from investors and notify me when one arrives."

Those tasks cannot run more frequently than once per hour. Each run also consumes Computer credits, including runs that check an inbox and find nothing. Perplexity advises customers to use the lowest cadence that meets their needs because hourly checks cost more credits than daily ones.

An event subscription changes that model. Gmail can tell Computer when a new message exists, allowing Perplexity to launch the workflow immediately instead of repeatedly waking an agent to inspect the inbox. That cuts the delay between receipt and action while potentially eliminating runs that do no useful work. The package does not establish how Perplexity would charge for event-triggered runs.

The client calls three backend route families to retrieve event definitions and manage subscriptions:

• /rest/triggers/event-schemas
• /rest/triggers/event-subscriptions
• /rest/triggers/event-subscriptions/{trigger_id}

The package also names events for sent, archived and deleted messages, draft creation, and Gmail label additions or removals. Those entries appear to be scaffolding for a broader event system. The currently exposed supported set appears limited to newly received messages.

Perplexity's public description of Computer, last modified on September 18th, already says the agent can monitor email, calendars, flight status and files with condition-based triggers. Its detailed task documentation still describes clock-based scheduling. The code reviewed by RuntimeWire shows the Gmail-specific subscription system that could connect those two product claims.

An external sender can wake the agent

An inbox event creates a sharper security boundary than a timer. Anyone who can deliver a matching email may be able to initiate a workflow, even though the package does not show that the sender can authorize any consequential action.

The risk depends on the workflow's permissions and where Perplexity requires human approval. Computer's documentation says the agent can manage email, write files, browse the web and chain multiple tools together. Perplexity's Personal Computer documentation says sensitive steps use on-device authorization, but it does not define which actions would require approval inside the event-triggered system reviewed by RuntimeWire.

Incoming email also gives attackers a direct path for indirect prompt injection: instructions placed inside a subject, message body or attachment and presented to the agent as data. A March 2026 red-team study recorded 8,648 successful attacks across 13 frontier models in tool-calling, coding and computer-use scenarios. Every model tested was vulnerable at some rate.

Perplexity says Computer scans external content with machine-learning classifiers and stops execution when it detects suspicious material. The company also says its tools label external content as untrusted and continue referring back to the user's original request while selecting actions.

Gmail triggers will put those defenses earlier in the execution chain. Perplexity will need to prevent duplicate deliveries, forwarded-message loops and automated replies from repeatedly starting workflows. Approval boundaries will determine whether a malicious message can influence a draft that a person reviews or cause Computer to act through another connected service.

The code establishes the trigger and subscription plumbing. It does not establish a launch date, customer eligibility or whether Gmail will be the only connector capable of waking Computer without a schedule.