{"slug": "perplexity-open-sources-numbat-to-monitor-and-block-risky-ai-agents", "title": "Perplexity open-sources Numbat to monitor and block risky AI agents", "summary": "Perplexity open-sourced Numbat on July 29th, a Go binary that monitors and can block risky AI agents on employee computers, addressing security risks from agents that run commands and access credentials on corporate systems. The tool, released under an Apache 2.0 license, collects agent activity from lifecycle hooks, OpenTelemetry, HTTP logs, and session artifacts, evaluating them locally with Common Expression Language rules. Numbat ships with 52 monitor-only rules across 11 behavior categories, and administrators can enable enforcement for agents with synchronous pre-action hooks.", "body_md": "Perplexity, the AI search company led by co-founder [Aravind Srinivas (@AravSrinivas)](https://x.com/AravSrinivas), open-sourced Numbat on July 29th, giving security teams a common monitoring and enforcement layer for AI agents running on employee computers. Perplexity [announced the release in a thread on X](https://x.com/perplexity_ai/status/2082511900580196596?s=46) and published the code under an Apache 2.0 license.\n\nThe release follows Srinivas's push to move Perplexity beyond its original answer engine and into agents that research, code and operate software for users. Srinivas, who earned a computer science PhD from UC Berkeley after studying at IIT Madras, interned at OpenAI and later worked there as a researcher before starting Perplexity in 2022, according to a [Berkeley Engineering profile](https://engineering.berkeley.edu/news/2025/03/berkeley-alum-wants-to-make-the-planet-smarter/). Numbat addresses a security problem created by that shift: agents can run commands, inspect files, access credentials and pursue tasks for extended periods on machines connected to corporate systems.\n\n### What Numbat watches\n\n[Numbat](https://github.com/perplexityai/numbat) ships as a single Go binary for macOS, Linux and Windows. It collects agent activity from lifecycle hooks and plugins, OpenTelemetry or HTTP logs, and session artifacts stored on disk. The software converts those inputs into a common event format and evaluates them locally with rules written using Common Expression Language, or CEL.\n\nThat architecture lets Numbat monitor current activity and reconstruct earlier sessions. Its scan function can read supported transcripts and other artifacts even when Numbat was installed after the session occurred. Normal output excludes complete raw transcripts, while operators can choose to send structured records to a local file or an HTTP destination.\n\nThe project's [coverage documentation](https://github.com/perplexityai/numbat/blob/main/docs/agent-coverage.md) lists integrations for agents including Claude Code, Codex, Gemini CLI, Cursor, Windsurf, GitHub Copilot CLI, OpenCode, OpenClaw and Pi. The depth of coverage varies by harness. Some integrations support stored-session analysis, live capture and pre-action enforcement, while others expose only part of that control surface.\n\nPerplexity included 52 rules organized into 11 behavior categories, according to its [technical post](https://research.perplexity.ai/articles/securing-agents-across-perplexity%E2%80%99s-client-endpoints-with-numbat). One rule looks for attempts to modify sudoers policy or create password-free root access. Another correlates a read from a secrets-management tool with a later attempt to transmit data through `curl`\n\nor `wget`\n\n. Operators can add their own YAML rules without changing Numbat's source code.\n\n### Blocking requires an explicit policy decision\n\nNumbat's headline capability is the option to stop selected agent actions before execution, but the default configuration is deliberately narrower. Every rule shipped by Perplexity is monitor-only. An administrator must copy or replace a rule, mark it for enforcement and install Numbat with enforcement enabled. Blocking works only when the underlying agent exposes a synchronous pre-action hook.\n\nThat distinction matters for enterprises evaluating Numbat as a control rather than an observability tool. OpenCode is monitor-only in the current coverage matrix, for example. Activity collected from stored artifacts or asynchronous telemetry can support investigations, but it cannot stop an action that has already occurred. The repository also documents host-specific gaps, including local hooks that do not cover some cloud-hosted tools.\n\nThe practical strength of Numbat will therefore depend on the fidelity of each harness integration and whether agent vendors maintain stable hooks, logs and artifact formats. Perplexity has built one event and policy layer across those differing interfaces, reducing the need for security teams to create a separate sensor for every coding agent their employees adopt.\n\n### Perplexity is releasing its internal control layer\n\nPerplexity says it already deploys Numbat across thousands of its own endpoints to monitor engineers using Claude Code, Codex, OpenCode and Pi. Each installation records activity locally and sends structured events and findings into Perplexity's central security systems.\n\nPerplexity Computer then reviews that telemetry on a recurring schedule, reconstructs suspicious sessions and gives additional scrutiny to actions that Numbat blocked, according to Perplexity. The agent also examines gaps in the rule set, proposes detection changes, tests them and opens pull requests for human review. Approved rules are deployed back across Perplexity's fleet.\n\nThat internal loop explains the timing of the open-source release. Perplexity is selling agent products that can take broader and longer-running actions, creating pressure to show enterprises how those systems can be observed after deployment. Numbat gives Perplexity a security layer that sits outside any individual model and can cover competing agent harnesses alongside its own products.\n\nThe design resembles endpoint detection and response software adapted for AI agents: collect behavior where it occurs, normalize it, detect risky sequences and optionally deny an action before the host executes it. Open-sourcing Numbat lets security teams inspect and modify that layer rather than relying on a closed gateway. Its value as an enforcement system still rests on the hooks provided by each agent and the policies that administrators choose to activate.", "url": "https://wpnews.pro/news/perplexity-open-sources-numbat-to-monitor-and-block-risky-ai-agents", "canonical_source": "https://runtimewire.com/article/perplexity-open-sources-numbat-ai-agent-security", "published_at": "2026-07-29 19:10:27+00:00", "updated_at": "2026-07-29 19:27:05.622549+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["Perplexity", "Aravind Srinivas", "Numbat", "Claude Code", "Codex", "Gemini CLI", "Cursor", "Windsurf"], "alternates": {"html": "https://wpnews.pro/news/perplexity-open-sources-numbat-to-monitor-and-block-risky-ai-agents", "markdown": "https://wpnews.pro/news/perplexity-open-sources-numbat-to-monitor-and-block-risky-ai-agents.md", "text": "https://wpnews.pro/news/perplexity-open-sources-numbat-to-monitor-and-block-risky-ai-agents.txt", "jsonld": "https://wpnews.pro/news/perplexity-open-sources-numbat-to-monitor-and-block-risky-ai-agents.jsonld"}}