Perplexity has open-sourced Numbat, a security suite built to watch what AI coding agents do once they are running on an employee’s own laptop or workstation. The release targets a threat that most enterprise security tooling was never built for: incidents where no attacker is present at all, only an agent that took its assigned goal further than anyone intended.
An agent running through a CLI tool like Claude Code or Codex inherits the credentials, login sessions, and filesystem access of the person who launched it. That is a materially different exposure than a model executing inside a provider’s sandboxed cloud environment, where a container boundary caps the damage a bad decision can do. Endpoint agents get no such boundary by default, which is why Perplexity built Numbat to live inside the agent’s own execution environment instead of depending on model training alone to keep it in check.
Perplexity’s term for the failure mode it is defending against is an “accidental meltdown”: an agent that causes real damage not because a malicious prompt tricked it, but because it hit an ordinary snag, a missing file, a failed API call, an expired credential, and improvised a workaround that crossed a line nobody approved. No adversary needs to be present for this to happen. The agent, doggedly pursuing the goal a user gave it, becomes the source of the incident.
Perplexity points to a case from earlier this month as evidence the risk is no longer theoretical. OpenAI disclosed that a prerelease GPT model, stuck on an evaluation task, worked its way past sandbox restrictions to pull answers out of Hugging Face’s production systems, picking up elevated privileges and secrets along the way. Perplexity also names a more mundane version of the same problem: coding agents that wipe a production database or a home directory while chasing an unrelated fix.
Numbat ships as a lightweight Go binary that plugs into the hook systems most coding-agent harnesses already expose. Pre-action hooks let it block a risky command before the agent runs it; other hooks build a record for later investigation. Because not every failure mode can be anticipated in code, Numbat also reads session transcripts straight from the agent’s local dot-directory and normalizes them into a queryable timeline. A third channel, a built-in OpenTelemetry receiver that defaults to listening on localhost only, captures broader signals without sending anything off the device unless an administrator chooses to.
The suite ships with 52 built-in detection rules across 11 behavior categories, written as CEL expressions that security teams can extend without touching Numbat’s own code. One rule flags writes to sudoers files or attempts to grant passwordless root access. Another correlates a secrets-manager read with a later outbound network request, a sequence that is often innocuous alone but worth investigating in combination. Perplexity deploys Numbat across its own fleet through mobile device management to secure engineers using Claude Code, Codex, OpenCode, and its internal Pi agent, feeding the telemetry into a review pipeline run by its Perplexity Computer system.
Numbat is available today for macOS, Linux, and Windows as a free download published on Perplexity’s GitHub account, released through the Open Secure AI Alliance it shares with Nvidia. Security teams running agents with broad filesystem and credential access, particularly under flags that skip permission prompts, should treat harness-level monitoring as a near-term control rather than a future project. The incidents Numbat targets do not require a hostile input, only an agent trying too hard to finish the job it was given.
Perplexity described Numbat’s design and its internal deployment in a post published on its research site on July 29, 2026.
