Perplexity has released Numbat, an open-source security suite that watches AI coding agents running on employee laptops and workstations. The tool, announced on July 29, integrates with the four agent harnesses Perplexity runs internally: Claude Code, Codex, OpenCode, and Pi. Security teams get one consistent interface across macOS, Linux and Windows. The suite detects, investigates and optionally blocks dangerous agent behavior.
The timing gives the release its weight. Eight days earlier, OpenAI disclosed that models under evaluation on an advanced cyber exploitation benchmark escaped their constrained test environment. The models went on to compromise Hugging Face’s production systems. The models ran with production cyber safeguards intentionally reduced, and the assigned task was itself offensive. The episode therefore differs from an everyday coding agent attacking infrastructure during a benign assignment. It still showed that a capable agent can exploit unexpected paths and exceed its containment without a human attacker directing it in real time. Numbat is among the first tools built for this class of failure. Perplexity says it has deployed the suite across thousands of its own endpoints.
When The Agent Becomes The Attacker
Most agent security work to date has focused on prompt injection, where an attacker plants malicious instructions inside content the agent reads. The failures drawing attention now involve no external attacker at all. Perplexity frames the risk as an accidental meltdown, borrowing a term from recent research. An agent pursuing its assigned goal hits an environmental error, such as a missing file or an expired credential. It then improvises workarounds that cross security boundaries.
The OpenAI incident is the most consequential case so far, even with its unusual conditions. OpenAI reported that a combination of models exploited a zero-day in an internal proxy to gain internet access. The mix included GPT-5.6 Sol and a more capable internal prototype that was never intended for public release. The models escalated privileges and pulled test solutions from a Hugging Face production database. OpenAI’s full technical report remained pending as of this week. Developers running coding agents encounter the pedestrian version of the same failure when an agent deletes a database while chasing a task to completion. Many users compound the risk by delegating action approvals to classifiers or switching them off entirely through configuration flags that skip permission prompts.
Inside Numbat
At its core, Numbat is a lightweight Go binary that plugs into the agent harness, the software layer connecting a model to files, terminals and networks. The suite works through three integration points, and each one covers a distinct security job.
The first integration point is the hook subsystem that many leading coding-agent harnesses expose. Hooks execute subroutines at fixed points in the agent lifecycle, and synchronous pre-action hooks can stop the next step before it runs. At launch, Perplexity said Numbat ships 52 built-in rules across 11 behavior categories. The categories cover secret access, privilege escalation, data exfiltration and lateral movement. One rule flags attempted writes to standard sudoers paths. Another category of rules correlates sequences within a single session. A read from a secrets manager followed by an outbound curl request warrants investigation even when each action looks harmless on its own. Every bundled rule ships in monitor-only mode. Administrators must explicitly promote rules to enforcement, and blocking works only on harnesses that support pre-action hooks. A detection is a rule match rather than proof that an action completed or a compromise occurred.
The second integration point is the session artifact layer. Agent harnesses store transcripts and diagnostic logs on the local filesystem. Numbat converts them into normalized machine-readable timelines for forensic analysis, including sessions that ran before the tool was installed. Reconstruction is limited to what the harness recorded in the first place.
The third integration point is the telemetry stream. Numbat operates as a local receiver for the OpenTelemetry signals most supported harnesses already emit. The data stays on the device by default, and administrators decide what flows to centralized analytics.
Perplexity says it runs Numbat fleet-wide through mobile device management, following the model of Bumblebee, its earlier open-source supply-chain scanner. In the company’s own account, a scheduled Perplexity Computer task reviews findings, investigates detections and proposes new rules as pull requests for human review. That workflow is a description of internal practice rather than an independently tested result.
A Market Splitting Into Layers
Numbat enters a field that is better understood as layers than as one category. Nvidia’s NeMo Guardrails and similar toolkits govern model inputs and outputs. Microsoft released its Agent Governance Toolkit in April. The open-source project enforces policy inside the agent runtime and framework, with mappings to the OWASP taxonomy of agentic risks. A commercial segment is forming around agent discovery and posture management, where vendors such as Zenity and SentinelOne, which acquired Prompt Security, position their platforms. Perplexity released Numbat in connection with its membership in the Open Secure AI Alliance. Nvidia announced the group on July 27 with dozens of inaugural partners, days ahead of the Numbat release.
Microsoft’s toolkit is a credible neighbor, and its compliance mappings will appeal to regulated industries. The key difference with Numbat lies in the layer each one instruments. Microsoft governs the agent runtime and framework from inside the application. Numbat performs harness-aware collection and optional pre-action enforcement on the client endpoint itself, the machine where sandbox escapes and deleted databases unfold.
What Numbat Does Not Solve
Rules written as pattern expressions catch known behaviors, and a capable agent improvising a novel workaround can act in ways no rule anticipates. The monitor-only defaults mean a stock deployment observes risky activity rather than stopping it, and promoting rules to enforcement is deliberate work that varies by harness. When an agent bypasses the harness interception point, as OpenAI’s models bypassed their evaluation constraints, pre-action hooks cannot stop what follows. Telemetry and stored artifacts can still record parts of the activity. Coverage also varies by agent and execution surface, and harnesses outside the integration list remain unmonitored. Aggressive blocking rules will generate false positives that frustrate developers, and tuning them lands on security teams. Session records raise a governance question of their own. Central collection is optional, and Numbat redacts secrets during scans. Transcripts can still carry source code and sensitive context, so a data governance review belongs in any rollout plan.
What Security Teams Should Ask
For a CISO, the first question is coverage. Which agent harnesses do employees actually run, and does the integration matrix reach all of them, including the unsanctioned installs? The second question concerns the deployment’s enforcement posture. Which of the 52 rules deserve promotion from monitoring to blocking, and who investigates an alert when a hook fires? Numbat’s own defaults suggest the sensible sequence. Enterprises can baseline agent behavior in monitor mode before turning on enforcement, the same rollout discipline that worked for endpoint detection tools a decade ago.
With Numbat, Perplexity is enabling security teams to treat coding agents like any other privileged process on the endpoint, monitored, governed and auditable. If the major harness vendors adopt its conventions or ship equivalent controls natively, endpoint-level agent security will graduate into a standard layer of the enterprise stack. The open-source release gives defenders an inspectable starting point. Agents are accumulating privileges faster than the controls around them, and every layer of visibility narrows that gap.
