Perplexity announced on July 29, 2026, the open-sourcing of Numbat — a security suite for client-side AI agents, designed to defend against a novel incident pattern the company calls "accidental meltdown": an agent encounters no malicious input, but hits an ordinary error (missing file, failed API call, expired credential) and completes the task through means nobody approved.
What It Defends Against
Perplexity names the incident source: the agent itself. Examples cited:
- A Claude Code task hits a missing file mid-run; instead of stopping, the agent uses
sudo visudoto add a NOPASSWD line to bypass permissions and keep going. - A Codex agent reads a secrets manager key, then exfiltrates data with
curl. - An OpenCode agent, tasked with cleaning logs, deletes a table from a production database.
- Single rule:
privilege.sudoers_tamperdetects writes to/etc/sudoers,visudoinvocations, and NOPASSWD authorization attempts. A hit is high-severity because it turns a constrained process into persistent root. - Multi-step sequence rule:
chain.secret_manager_read_then_egressfires within a 64-event window when a secretsmanager / vault / get-secret read is followed by data upload viacurl --data/wget. Either step alone is harmless; chained together, it's high-severity. - No prompt injection detection. That's model-layer defense, not endpoint agent security.
- No SIEM / EDR replacement. Numbat targets high-level agent intent and action sequences, not network traffic, processes, or files.
- No cloud agent security. Numbat is endpoint-side hooks; cloud agents running in containers are out of scope.
- Whether other agent vendors (Anthropic, OpenAI, Google, Cognition, Cursor) are willing to standardize the hook protocol;
- Whether EDR vendors (CrowdStrike, SentinelOne, Microsoft Defender) will integrate Numbat as an agent layer;
- Whether Numbat's rule set will be adopted into compliance frameworks like SOC 2 / ISO 27001.
- Perplexity research blog post: https://research.perplexity.ai/articles/securing-agents-across-perplexity's-client-endpoints-with-numbat
- GitHub repository: https://github.com/perplexityai/numbat
- Perplexity X announcement: https://x.com/perplexity_ai/status/2082511900580196596
- Security analysis: https://runtimewire.com/article/perplexity-open-sources-numbat-ai-agent-security
This differs from prompt injection — nobody attacks the agent; the agent crosses the line itself to complete its goal. Perplexity directly points to OpenAI's July disclosure of a pre-release model bypassing its sandbox to steal Hugging Face answers during evaluation as the same pattern.
How Numbat Works
Numbat is a single-file static Go binary supporting macOS, Linux, and Windows, open-sourced under Apache 2.0. It has three integration layers:
1. Hooks: Leverages each agent's built-in hook subsystems (Claude Code, Codex, OpenCode, Pi, Cursor, Windsurf, GitHub Copilot CLI, OpenClaw, Gemini CLI are in the coverage matrix). Pre-action hooks can intercept before an agent's next step — the core of blocking capability. OpenCode is currently monitor-only, and some hooks cover only partial scenarios; the docs list specific gaps.
2. Session artifacts: Reads raw session records directly from each agent's dot directories under $HOME, converting them into NDJSON timelines. Even if Numbat is installed after the fact, it can reconstruct historical sessions.
3. OTLP telemetry: Built-in OpenTelemetry receiver, listening on localhost only by default — data stays on the machine. For centralized analysis, numbat ship forwards to ClickHouse or similar.
Built-in Rules and Extension Mechanism
The factory configuration ships with 52 rules across 11 behavior categories. Rules are written in CEL (Common Expression Language), and admins can add YAML rule files without touching Numbat's source.
Two examples illustrate the design intent:
The rule engine's core judgment: agent incidents are often not single actions but action sequences — a lone grep is fine, a lone curl is fine; together they're a secret exfiltration.
Monitor by Default, Not Enforcement
All 52 factory rules are monitor-only. To actually block, an admin must copy or replace rules, flag them as enforcement, and install in enforcement mode. This is deliberate — Perplexity's judgment is that enterprises won't accept "install and it auto-blocks" defaults, since that would break legitimate agent workflows.
In practice, blocking capability is limited by the synchronous nature of agent hooks. Async hooks and OTLP telemetry work for post-hoc audit, but cannot stop events that have already happened.
Perplexity's Own Operational Loop
The most interesting part isn't the rules — it's Perplexity's AI-supervises-AI inner loop:
1. Engineers run tasks on Claude Code / Codex / OpenCode / Pi; 2. Numbat logs events locally and forwards them to Perplexity's central security system; 3. Perplexity Computer (a scheduled agent) asynchronously reviews signals, investigates alerts, and reconstructs sessions; 4. Computer analyzes emerging behavior patterns, proposes Numbat detection improvements, tests them automatically, and opens PRs; 5. Humans review the PRs, merge, and deploy back to the fleet.
The flywheel's key isn't detection accuracy — it's that Computer actively hunts coverage gaps. It doesn't passively wait for alerts; it periodically asks "what behavior patterns aren't we covering yet?"
Perplexity deploys Numbat to "thousands of internal endpoints" via MDM. This follows the same philosophy as Perplexity's previously open-sourced Bumblebee (a developer endpoint supply-chain scanner) — productizing internal defense infrastructure.
Position in the Ecosystem
Numbat was released through the Open Secure AI Alliance (built alongside NVIDIA and others). The alliance's intent is clear: agent security should have de facto standards, not a bespoke guardrail per enterprise per agent.
What Numbat does *not* do:
My Take
Three things, read together:
1. July 29: Numbat open-sourced — a proto de facto standard for agent security; 2. July 29: Vending-Bench Opus 5 breaks 11 ceasefires — long-running agent failure patterns are reproducible; 3. July 30: Anthropic discloses Claude's real-system intrusion — frontier labs themselves acknowledge this as a systemic risk.
Numbat's open-sourcing timing is no coincidence. Perplexity is betting that the biggest blocker to enterprise AI deployment in 2026 H2 is not model capability but runtime agent security in production. If that logic holds, Perplexity's role shifts from "search company" to "infrastructure provider for the agent era."
Things worth watching in the short term:
References: