Perplexity
Sources: Perplexity (homepage) · Unprompted March 2026 — BrowseSafe talk · Numbat announcement
Conversational-search and browser-agent vendor; operates a production browser-agent that fetches and reasons over web content on behalf of the user. Perplexity appears in this wiki on two distinct security surfaces: as the operator of BrowseSafe, a fine-tuned in-line classifier defending the production browser-agent against prompt injection, and as the publisher of Numbat, an open-source agent security suite for enterprise client endpoints.
The two positions sit on opposite sides of the injection threat model. BrowseSafe is a classifier defense against adversarial input; Numbat is built for the accidental meltdown case, where no adversarial input exists at all.
BrowseSafe
Presented at Unprompted March 2026 by Kyle Polley — “Training BrowseSafe: Lessons from Detecting Prompt Injection in Production Browser Agents” (Day 2 / Stage 1 / 14:20). Reported numbers: F1 ~0.91 at sub-100ms latency, fine-tuned MoE Qwen-30B base; companion benchmark BrowseSafe-Bench with high-entropy realistic HTML; data flywheel from production user feedback.
The talk is a primary practitioner case study on production-scale indirect prompt injection detection at the browser-agent boundary.
Numbat and internal security tooling
Numbat is Perplexity’s open-source agent security suite for client endpoints, released through the company’s Open Secure AI Alliance membership and summarized at Numbat Agent Security Suite. It integrates with coding-agent harnesses through hooks, filesystem session artifacts, and OTLP telemetry.
Perplexity reports running it across its own fleet, distributed by MDM alongside Bumblebee, an open-source scanner for supply-chain exposure on developer endpoints. Perplexity Computer, the company’s agentic system, reviews Numbat findings on a schedule, reconstructs sessions, and opens pull requests proposing new detection rules for human review. The securing-AI control supplies the telemetry that the defending-with-AI workflow consumes.
See also
- Unprompted March 2026 — talk venue
- Indirect Prompt Injection — the threat class BrowseSafe targets
- Numbat — open-source agent security suite
- Accidental Meltdown — the threat model Numbat is designed against
- Open Secure AI Alliance — release vehicle