• Signal: Perplexity's announcement says Teammates are personal agents for long-running work that remember project goals, task history and shared files across runs.
• Signal: Teammates act without a fresh query, hold encrypted saved credentials, and can be given GitHub repositories and Slack channels, so a successful injection could reach real systems.
• Perplexity's post says Teammates launch for Max subscribers; the $200-per-month price comes from The Decoder, not from Perplexity's post.
• The Decoder says each Teammate runs on its own virtual machine; Perplexity's post says only 'a separate environment' with isolated browser sessions.
• Noise: the post gives no benchmark, no failure rates and no red-team results, so reliability and attack resistance are undemonstrated.

Perplexity's Teammates matter less for their price than for what they are allowed to touch. In its 4 November 2026 announcement, Perplexity describes persistent agents that remember project history, act without a fresh query, hold encrypted saved credentials and work against GitHub repositories and Slack channels. Perplexity published no benchmark or attack-resistance data, so everything below is what the vendor says, not what has been tested.

What Perplexity says Teammates do

Perplexity's post calls Teammates personal agents for long-running work. They plan and coordinate projects, remember project goals, task history and shared files across runs, and monitor ongoing work, investigating and acting without waiting for a new query. A teammate coordinates Computer sessions and other teammates. The Decoder contrasts this with Perplexity Computer, which it says executes one-off assignments.

The access model is the security story

Teammates combine memory, autonomy and delegated access, which is the combination injection attacks exploit. Perplexity's setup steps let users add Slack, GitHub or Gmail plugins and choose which GitHub repositories a teammate can reach. Colleagues can hand work to a teammate in a Slack channel, and teammates can pass work to each other. Any of those inputs is a channel for untrusted text.

Controls described, and what is missing

Perplexity describes some containment: each teammate runs in a separate environment with browser sessions isolated from other teammates, saved credentials are encrypted, and users can review work, take over the desktop or redirect an agent. It says teammates build on Computer's existing tool and Project permissions. The post describes no prompt-injection testing, no action logging format and no approval gate for risky actions. Those gaps are untested, not proven flaws.

Where the reports diverge

The Decoder, dated 6 November 2026, reports that each Teammate runs on its own virtual machine and that the Max plan costs $200 per month. Perplexity's post uses neither claim. It says 'a separate environment' with a desktop users can take over, and says only that Teammates launch on the web, and soon on iOS, for Max subscribers. Treat the virtual-machine detail and the price as reported by The Decoder, not confirmed by Perplexity's post.

Price in context

The Decoder places the $200 Max price against Dots from $100 and Duet from $20, which it lists as OpenAI's and Anthropic's agents, and argues the cheaper options will likely hit usage limits fast. That is the author's opinion, not a measurement. No cost-per-completed-task figure exists for any of these products in the sources reviewed, so list price alone cannot show which is cheaper to run.

Verdict

Treat the launch as Signal that vendors are moving to persistent agents with standing credentials, and as Noise on capability until someone measures it. Before granting access, a team should scope GitHub repositories narrowly, use throwaway credentials, and test whether text planted in a Slack message or a web page can redirect a teammate. Watch for Perplexity's logging and approval documentation and for independent red-team results.