Numbat

Announcement: Securing Agents Across Perplexity’s Client Endpoints with Numbat (Perplexity Research, July 2026) · summarized at Numbat Agent Security Suite

Open-source agent security suite from Perplexity, distributed as a lightweight static Go binary for macOS, Linux, and Windows. Numbat detects, prevents, and investigates risky behavior by coding agents running on client endpoints, and presents one interface across the several harnesses a developer fleet has installed.

Function

Numbat attaches to an agent harness at three points. Hooks provide real-time detection, and the pre-action variety can block an action before it executes. Session artifacts, read directly from the harness dot-directory under $HOME and normalized to NDJSON timelines by numbat scan, provide retrospective forensics — including for sessions that ran before Numbat was installed. OTLP telemetry, received locally by numbat collect, supplies fleet monitoring signals that hooks and artifacts do not carry.

Detection content ships as 52 built-in rules across 11 behavior categories, written as CEL expressions over normalized events, together with multi-step sequence detections for secret access, exfiltration, privilege escalation, and lateral movement. Operators add rules and tests without modifying Numbat’s source.

Deployment posture

Telemetry is local-first: the numbat collect receiver binds to localhost by default, and nothing leaves the endpoint until an operator configures it to. Remote shipping runs through numbat ship, with ClickHouse named as an analysis destination. Perplexity distributes Numbat across its own fleet by MDM and reports using it against Claude Code, Codex, OpenCode, and Pi.

Position

Numbat sits between two control types the wiki already records: harness-native permission systems, which enforce inside a single harness (Claude Code Security), and static configuration auditing, which reads harness config without observing execution (AgentShield). Numbat observes and blocks at runtime, across harnesses. Its distinguishing design commitment is the accidental meltdown threat model — an agent crossing security boundaries without any adversarial input — which is what motivates placing prevention in the harness rather than the model.

The session-artifact route has one prior production implementation: Uber’s ADR sensor, which parses the same class of local harness caches at fleet scale and already pairs that route with inline-hook blocking (arXiv:2605.17380). Numbat’s addition relative to ADR is the OTLP receiver, four harnesses rather than three, and availability as an open-source binary.

The OTLP path converges with the direction argued in GenAI Endpoint Observability: agent-hook signals routed through OpenTelemetry GenAI semantic conventions into the SIEM, because raw EDR telemetry cannot separate a developer’s shell command from an agent’s.

Unverified release specifics

The repository URL, license identifier, and version are not stated in the announcement, and the site was unreachable from the ingest environment. Confirm all three against the published repository before citing Numbat as a deployable control.