Can Liquid AI's LFM2.5-2.6B Really Keep Agent Data On-Device?

August 7, 2026

Liquid AI's LFM2.5-2.6B can run locally, but tools, downloads, and telemetry can still send agent data over the network. Here is how to verify the full privacy boundary.

Yes—but only if the whole agent stack, not just the model, stays local. Liquid AI's new 2.69-billion-parameter LFM2.5-2.6B can run on phones and computers through local runtimes, so prompts and generated text do not have to go to a hosted inference API. But model downloads, web research, location lookup, telemetry, remote tools, and cloud-hosted interfaces can still send data over the network.

Watch The 30-Second Summary

Watch this video on YouTube

That distinction matters because “on-device model” and “all data stays on-device” are not interchangeable claims. LFM2.5-2.6B gives developers the parts needed for genuinely local inference. Whether an actual agent is private depends on how those parts are assembled.

What Liquid AI Released

Liquid AI announced LFM2.5-2.6B on August 5, 2026 as a small agentic model designed for phones, laptops, PCs, and robots. The official Hugging Face model page lists 2,697,198,592 parameters, a 131,072-token context limit, tool-calling support, and downloadable weights.

The company says the model was pretrained on about 34 trillion tokens and then post-trained for multi-step reasoning and tool use. It publishes deployment paths for several local and hosted environments:

Liquid AI reports that a quantized version stays under 2.5 GB in its reference CPU tests. It says the model generated 220 tokens per second on an Apple M5 Max, 113 tokens per second on an AMD Ryzen AI Max+ 395, and 30 tokens per second on a phone.

Those are vendor measurements, not an independent guarantee for every prompt, quantization, context length, operating system, or device. They do establish the intended deployment class: this is a model built to make useful local inference plausible without a data-center GPU.

At the time of our review, the base model showed about 78,000 Hugging Face downloads and 357 likes. Liquid AI's official GGUF repository showed about 31,000 downloads and 136 likes. A fresh LocalLLaMA release discussion had roughly 140 votes. That is meaningful early interest, though it is not proof of production reliability or privacy.

What Is Confirmed

Several parts of the local-inference claim are directly verifiable.

The Weights Are Downloadable

The model is not limited to a hosted chat endpoint. Its weights can be downloaded and loaded by software running on hardware you control. Liquid's llama.cpp deployment guide explicitly positions llama.cpp for CPU-only environments, local development, edge deployment, and on-device inference.

Once a compatible model file and runtime are present, text generation can happen without sending the prompt to Liquid AI or another inference provider.

There Are Multiple Local Runtime Paths

Users are not locked into a single proprietary application. The official model card documents local desktop, command-line, browser, and Apple-silicon options. That makes it possible to choose a runtime whose networking and storage behavior can be inspected.

Tool Calls Are Requests, Not Actions Performed By The Model

The model card makes an important architectural point: the model can generate structured function calls, but the surrounding application executes them.

If the model proposes search_wikipedia, the model itself does not contact Wikipedia. The agent harness reads the proposal, decides whether it is allowed, makes the request, returns the result, and may pass that result back into the model.

This separation is good for control—but it also means a model's local execution tells you almost nothing about the privacy of its tools.

Liquid AI Published A Browser-Only Demonstration

The official LFM2.5 Edge Research Agent Space uses Transformers.js, ONNX, and WebGPU to run the model in the browser. Its public repository describes it as a browser-only research agent.

We inspected the mirrored source code. The inference pipeline is loaded in a web worker, and model artifacts are fetched from Hugging Face for use by the browser. That is materially different from sending each prompt to a hosted language-model API.

What Is Still Unclear

The release does not prove that every application labeled “powered by LFM2.5-2.6B” keeps every piece of user data on the device.

“Data Never Leaves” Depends On The Application

Liquid AI's launch language says data never leaves the device. That is defensible for a correctly configured local inference path with no networked tools. It is too broad if applied automatically to every agent built around the model.

An application can run inference locally while still transmitting:

The model weights do not govern those paths.

The Official Research Demo Uses Networked Tools

The browser demo is a particularly useful example. Its model inference can run on-device, but its research tool calls Wikipedia's live API. If a user enables location-aware context, the code can request browser geolocation and send coordinates to a third-party reverse-geocoding service.

That does not make the demo deceptive or unsafe. A research agent needs external information somewhere. It does mean the accurate privacy statement is narrower:

The model can reason locally while selected tools make disclosed network requests.

That is not the same as an air-gapped or fully offline agent.

There Is No Independent End-To-End Privacy Audit

We found public source code for the demonstration and official documentation for the weights and runtimes. We did not find an independent audit proving that every supported application, build, tool, or installation mode has no unexpected network behavior.

Users should evaluate the exact application and version they plan to run. A local model can be embedded inside software with its own analytics, update service, cloud sync, extensions, or connectors.

Long Context Does Not Mean Unlimited Private Document Use

The model advertises a 128K context window. Real memory use rises with context length, runtime, cache format, and quantization. A short-chat benchmark under 2.5 GB does not prove that a phone can process a full 128K-token private archive comfortably.

The model card also recommends the release for tool use, extraction, retrieval-augmented generation, and long-context tasks, while saying it is not recommended for agentic coding or knowledge-intensive work. Users should test their own documents and failure cases before treating it as a private replacement for a much larger hosted model.

The Five-Part Test For A Truly On-Device Agent

Use this test before trusting any local AI privacy claim.

Layer Question to ask What good evidence looks like
Model Where does inference run? Process, CPU/GPU use, and runtime are visible on your device
Storage Where are prompts, files, caches, and outputs saved? Documented local paths and controls for deletion or persistence
Tools Which actions contact external services? Per-tool disclosure, permission gates, and a clear destination list
Telemetry Does the app send diagnostics, analytics, or identifiers? A documented setting plus network evidence that the setting works
Updates What happens during startup, model download, and upgrades? Signed sources, visible download endpoints, and an offline mode after setup

Passing the first row is not enough. An agent is only as local as its least-local data path.

1. Verify The Inference Process

Disconnect the network after the model has been downloaded. Start a new session and submit a prompt that does not need current information. If generation completes, that is strong evidence that inference can run locally.

It is not proof that the application never reconnects later. Repeat the test after restart and inspect actual connections.

2. Inspect Network Traffic

Use operating-system network tools, a firewall prompt, or a local proxy to observe outbound destinations during:

Label each connection by purpose. Downloading model weights once is different from sending every prompt to a server, but both are network activity.

Our guide to verifying local-only AI behavior explains the same evidence-first method for Ollama. The principle applies to any runtime: verify what the process does, not just what the marketing page calls it.

3. Separate Search From Generation

A local model can use web search and still keep the final inference step on-device. The search service must nevertheless receive enough information to answer the query.

The privacy boundary can be improved by minimizing queries, removing sensitive identifiers, using a privacy-focused search layer, or maintaining a local document index. It cannot be improved by pretending the search request never left.

For a deeper breakdown, see Can Local AI Use Web Search And Still Stay Private?.

4. Review Every Tool Permission

An agent with file, shell, email, browser, calendar, or location tools has a larger data boundary than a text-only model. Ask:

Local inference reduces one form of disclosure. It does not automatically sandbox the agent or make its proposed actions trustworthy.

5. Check Persistence And Deletion

Find the directories used for chats, caches, vector indexes, downloaded models, and generated artifacts. Delete a test conversation and verify whether its related files disappear.

Also check backups, browser storage, crash dumps, and synchronized folders. “Not sent to the model provider” does not mean “not stored anywhere.”

Does The License Make LFM2.5-2.6B Open Source?

The weights are publicly downloadable, but the license has a commercial-use threshold that matters.

The LFM Open License v1.0 defines its threshold as annual revenue of $10 million or more. It says the agreement does not license commercial use by a legal entity that exceeds that threshold. Larger organizations need separate commercial rights from Liquid AI.

That is different from an Apache 2.0 or MIT-style grant without a revenue ceiling. “Open weights” is the more precise description.

Individual users, researchers, nonprofits, startups, and enterprises should read the actual license for their situation. This article is not legal advice.

How LFM2.5-2.6B Compares With Hosted Private AI

Local and hosted privacy are different engineering choices, not a simple good-versus-bad ranking.

Priority A local LFM2.5-2.6B setup may fit better A hosted privacy-focused workspace may fit better
Strict inference locality You can install, verify, and maintain a local runtime Not the right choice if no provider processing is acceptable
Capability breadth You need a narrow text, extraction, or tool-routing workflow You want chat, search, files, voice, images, or video in one service
Setup and maintenance You are comfortable managing models, updates, storage, and tools You prefer a ready-to-use product
Model capability Your task works reliably on a 2.69B model You need access to broader hosted capabilities
Networked information You can control each tool and disclosure path You want integrated private search without building the stack

OpenVeil is a hosted privacy-focused AI workspace, not a fully offline local model. It offers private chat and search, file work, voice, image and video tools, and browser-local chat history. OpenVeil does not create a normal server-side chat-history record and does not train foundation models on prompts, uploads, images, audio, local context, or outputs.

Active requests still require processing by OpenVeil and necessary providers. If your requirement is that prompt inference never leave your device, use a verified local runtime. If you want a broader ready-to-use workspace without managing a local stack, OpenVeil starts with a one-time 10-action preview and paid plans from $10 per month.

The detailed comparison in Private AI Chat Vs. Local AI can help you choose the boundary that actually matches your work.

What LFM2.5-2.6B Changes

The most important part of this release is not a benchmark win. It is the shrinking hardware cost of keeping useful model inference close to the user.

A 2.69B model that can plan, emit function calls, summarize, extract data, and operate at usable phone or laptop speed makes local-first architecture available to more developers. It can reduce routine dependence on hosted inference and make per-task disclosure a design choice rather than a default.

But the release also exposes why “local AI” needs more precise language.

There are at least four different claims:

  1. The weights are downloadable.
  2. The model can run on-device.
  3. The current inference runs on-device.
  4. The complete application keeps all user data on-device.

LFM2.5-2.6B clearly supports the first two. A developer or user must verify the third. Only an audit of the full application can establish the fourth.

A Practical Privacy Checklist

Before putting sensitive material into an LFM2.5-2.6B application, confirm:

If an application cannot answer those questions, “on-device” is a deployment hint—not a complete privacy policy.

Frequently Asked Questions

Does LFM2.5-2.6B Send Prompts To Liquid AI?

It does not have to. When the downloadable model runs through a local runtime, inference can happen on your device without sending prompts to Liquid AI. A particular application may still make other network requests, so verify the app rather than relying on the model name alone.

Can LFM2.5-2.6B Run Fully Offline?

Core inference can run offline after the required weights and runtime are installed. Web search, remote APIs, cloud connectors, model downloads, and other networked tools will not work offline. Some applications may also include update or telemetry connections.

Is Liquid AI's WebGPU Agent Fully Offline?

No, not for its complete research workflow. The model inference runs in the browser, but model assets are downloaded from Hugging Face and the research tool calls Wikipedia's API. Its optional location flow can call a reverse-geocoding service. After assets are cached, a plain non-research prompt may have a narrower network boundary.

Is LFM2.5-2.6B Open Source?

The weights and code paths are publicly available, but the LFM Open License v1.0 restricts commercial use for entities with annual revenue of $10 million or more. “Open-weight model under the LFM Open License” is the more precise description.

Does A Local Model Prevent Prompt Injection?

No. Prompt injection concerns untrusted content influencing an AI system's instructions or tool use. Local inference can reduce data disclosure to a model provider, but it does not stop malicious documents or webpages from manipulating an agent. Tool permissions and isolation still matter.

Is LFM2.5-2.6B Better For Privacy Than OpenVeil?

It offers a stricter locality option when you run and verify it entirely on your own hardware. OpenVeil is hosted and supports a broader set of ready-to-use capabilities. The better choice depends on whether you prioritize no hosted inference, broader tools, ease of use, or model capability.

The Bottom Line

LFM2.5-2.6B makes on-device agent inference credible on much smaller hardware. That can keep prompts, documents, and generated text away from a hosted model endpoint.

It does not make every agent built with the model fully local. The official browser demo itself shows the boundary clearly: reasoning can stay on-device while research and location tools contact outside services.

Treat local privacy as a system property. Verify the model, storage, tools, telemetry, and update path. If all five stay within the boundary you intend, LFM2.5-2.6B can be part of a genuinely private local agent. If they do not, the word “on-device” tells only part of the story.

When privacy, account control, uploads, and search matter, OpenVeil gives you a private AI workspace designed for that job.