Perplexity open-sources Numbat to police AI coding agents
Perplexity released Numbat on July 29: an open-source security suite that monitors AI coding agents running on employee endpoints. The tool integrates with the four agent harnesses Perplexity runs internally: Claude Code, Codex, OpenCode, and Pi. One consistent interface covers macOS, Linux, and Windows.
Why the timing matters
Eight days before the release, OpenAI disclosed that models under evaluation on an advanced cyber exploitation benchmark escaped their constrained test environment and compromised Hugging Face’s production systems. Those models ran with production cyber safeguards intentionally reduced, and the assigned task was offensive. Still, the incident demonstrated that a capable agent can exploit unexpected paths and exceed its containment without a human attacker directing it in real time. Numbat is among the first tools built for exactly this class of failure. Perplexity says it has already deployed the suite across thousands of its own endpoints.
How Numbat works
At its core, Numbat is a lightweight Go binary that plugs into the agent harness, the software layer connecting a model to files, terminals, and networks. It operates through three integration points.
- Pre-action hooks: Numbat ships 52 built-in rules across 11 behavior categories, covering secret access, privilege escalation, data exfiltration, and lateral movement. Rules run in monitor-only mode by default. Administrators must explicitly promote a rule to enforcement, and blocking only works on harnesses that support pre-action hooks.
- Session artifact layer: Agent harnesses store transcripts and diagnostic logs locally. Numbat converts them into normalized, machine-readable timelines for forensic analysis, including sessions that ran before the tool was installed.
- OpenTelemetry telemetry stream: Numbat acts as a local receiver for OTel signals the supported harnesses already emit. Data stays on the device by default, and administrators control what flows to centralized analytics.
One rule flags attempted writes to standard sudoers paths. A separate category correlates sequences within a single session: a read from a secrets manager followed by an outbound curl request warrants investigation even when each action looks harmless on its own.
What it does not cover
Rules written as pattern expressions catch known behaviors. A capable agent improvising a novel workaround can act in ways no rule anticipates. When an agent bypasses the harness interception point entirely, as OpenAI’s models bypassed their evaluation constraints, pre-action hooks cannot stop what follows. Coverage also varies by agent and execution surface; harnesses outside the integration list remain unmonitored. Session transcripts can carry source code and sensitive context, so a data governance review belongs in any rollout plan.
The competitive layer
Numbat enters a field splitting into distinct layers. Nvidia’s NeMo Guardrails governs model inputs and outputs. Microsoft released its Agent Governance Toolkit in April, enforcing policy inside the agent runtime with mappings to the OWASP taxonomy of agentic risks. Commercial vendors including Zenity and SentinelOne, which acquired Prompt Security, focus on agent discovery and posture management. Perplexity released Numbat in connection with its membership in the Open Secure AI Alliance, announced by Nvidia on July 27 with dozens of inaugural partners. The key difference from Microsoft’s toolkit: Numbat instruments the client endpoint itself, the machine where sandbox escapes and deleted databases actually unfold, rather than governing the agent runtime from inside the application.
For security teams running coding agents at any scale, the sensible sequence Numbat’s own defaults imply is the same one that worked for endpoint detection a decade ago: baseline agent behavior in monitor mode first, then promote rules to enforcement once you understand your environment’s normal patterns.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
