Perplexity opens Numbat for pre-action agent detection and response

• Numbat is Perplexity's open-source agent detection and response layer, and Perplexity's launch post says it can block selected actions before execution.
• The layer spans desktop, CLI, IDE, and gateway agents; Perplexity's follow-up lists live monitoring, local detection, pre-action blocking, and forensic reconstruction.
• Distribution is simple: Perplexity's release note says Numbat ships as a single Go binary for macOS, Linux, and Windows under Apache 2.0.
• Enforcement has a major gotcha: Numbat's README says all shipped rules are monitor-only, even though the launch post foregrounds pre-action blocking.
• The release sits inside a broader open-security push, with AravSrinivas's Bumblebee post naming a read-only scanner and his BrowseSafe post naming a prompt-injection benchmark for browser agents.

The README includes deny examples for cloud metadata fetches, secret-read-then-egress chains, and Codex writes to authorized_keys. Perplexity documents 27 agent rows in the coverage matrix, including Claude Code, Codex, Gemini CLI, Cursor, Windsurf, Copilot, Pi, Kimi Code, Qwen Code, Cline, Amp, Kiro, Goose, OpenHands, Crush, Junie, Antigravity, Factory Droid, Grok Build, Devin CLI, and Hermes. The enforcement guide hides the sharp edge: --enforce alone does not turn Perplexity's shipped detections into blocks.

Perplexity's research post frames Numbat as a system-level guardrail for agent harnesses, not a model-level safety patch. Its core bet is old-school endpoint security for agents: normalize actions, evaluate rules locally, and ask the host to deny risky tool calls before execution.

Numbat's GitHub README describes the project as endpoint visibility into agent activity, with local detection, optional pre-action blocking, and forensic reconstruction. The same repo lists Go as the implementation language and Apache 2.0 as the license.

Numbat observes agents through three paths, according to the agent coverage docs:

1. On-disk session artifacts for forensic reconstruction.
2. Synchronous hooks, plugins, and extensions for live capture and pre-action gates.
3. OTLP or HTTP logs for telemetry.

The README says live and at-rest activity are normalized into one event model and evaluated by the same CEL rule engine. That gives security teams one rule surface across agents that otherwise expose different hook files, plugin APIs, transcripts, and log formats.

Perplexity's coverage matrix is the article engineers will keep open in another tab. It separates three capabilities for each host: at-rest artifacts, live capture, and enforcement.

A few implementation details matter more than the long logo list:

• Claude Code: at-rest artifacts live under $CLAUDE_CONFIG_DIR or ~/.claude; enforcement uses PreToolUse.
• Codex: app, CLI, and IDE sessions share the root, but hosted tools bypass the local hook path.
• Cursor: local sessions use ~/.cursor/hooks.json; Cursor Cloud does not load that user hook file and may perform initial read-only exploratory turns before hooks begin.
• OpenCode: live plugin capture is supported, but enforcement is currently monitor-only.
• OpenHands: hooks are repository-scoped, so it is excluded from --agent all and requires an explicit .openhands/hooks.json path.
• Junie CLI: payloads have no session id or cwd, so cross-event sequence correlation is unavailable.

The matrix also distinguishes parser-backed artifact paths from deferred stores. Current opencode.db, several SQLite stores, Qwen conversation storage, and Antigravity transcript schemas are documented as deferred rather than silently implied.

Numbat does not execute, cancel, or rewrite tools itself. The enforcement guide says the agent host remains the enforcement point.

The control flow is explicit:

1. The model proposes a tool action.
2. The host invokes a pre-action hook.
3. Numbat validates and normalizes the payload.
4. Numbat evaluates CEL rules and emits operator records.
5. On a clean enforced match, Numbat returns the host's native deny response.
6. The host decides whether to execute, prompt, or reject.

The gotcha is rule effect. Numbat hooks monitor by default, every shipped rule is monitor-only, and severity does not enable blocking. Blocking requires an enabled rule with enforce: true, a supported synchronous pre-action hook, valid normalized input, successful record emission, and a clean deny path.

Post-action hooks, OTLP records, and at-rest artifacts are observation-only. The enforcement guide defines fail-open as Numbat withholding its deny response, while the host may still prompt, deny, time out, or apply another policy.

Perplexity's built-in rule catalog reads like an agent-specific EDR starter pack. The catalog is enabled for detection, not blocking, by default.

The categories are concrete:

• Secrets: .env files, SSH private keys, cloud credentials, browser session stores, Kubernetes tokens, developer credential stores.
• Exfiltration: credential-bearing curl or wget, DNS tunneling, secret-manager reads followed by network transfer.
• Execution: download-pipe-shell, reverse shells, reverse tunnels, encoded shell payloads, destructive recursive deletes, agent runtime bypass flags.
• Reconnaissance: cloud metadata fetches, privilege enumeration, network sweeps.
• Privilege: sudoers writes, container host escape primitives, elevated shells, container runtime socket access.
• Persistence: shell profile writes, scheduled jobs, Git hook writes, authorized_keys mutation, privileged account changes.
• Sequences: secret-read-then-egress, guardrails-off-then-egress, permission-denied-then-runtime-bypass, workload-token-then-lateral-execution.

A pre-action finding describes a requested action, not proof that the action completed. The rule catalog makes that distinction explicit.

Numbat's README says scan, timeline, and case-bundle commands work against existing artifacts without prior instrumentation. That turns persisted agent traces into incident material after the fact, as long as the upstream agent actually wrote the relevant events.

The record format is built for downstream tooling:

• Versioned NDJSON records cover events, findings, enforcement decisions, indicators, and scan summaries.
• Events and findings retain source references.
• JSON Schemas define the wire format.
• Normal record output redacts secrets and does not include a complete raw transcript.
• Raw evidence files in a case bundle are opt-in.
• Case bundles include SHA-256 manifests.

The README's scope section gives the caveat: at-rest reconstruction is not disk or memory acquisition, cannot recover activity an agent did not persist, and findings are rule matches rather than proof of compromise.

Perplexity says Numbat runs across its systems and sends audit events, findings, and security alerts to Computer. Computer then analyzes telemetry, escalates suspicious behavior, and proposes new on-device detections for Numbat.

That loop is the productized version of the security data flywheel Perplexity also described in its BrowseSafe research post: flagged boundary cases become material for new synthetic training samples and detector updates.

AravSrinivas tied Perplexity's open-security push to a Hugging Face breach, saying closed tools could not distinguish attackers from defenders and blocked forensic analysis. He said Hugging Face ended up running open-weight GLM 5.2 on its own infrastructure to contain the incident.

Perplexity's Bumblebee announcement says Bumblebee is a read-only scanner for risky packages, extensions, and AI tool configs on developer machines. It does not execute code, invoke package managers, or read source files during scans.

BrowseSafe covers a different surface: browser agents reading hostile web content. Perplexity's BrowseSafe post introduces a benchmark, dataset, model, and paper for prompt injection in agentic browsing systems, while AravSrinivas's BrowseSafe post describes it as an open benchmark for protecting agents against website prompt injection.

The NVIDIA Open Secure AI Alliance announcement lists Perplexity among the inaugural members. NVIDIA frames the alliance around open models, open harnesses, and open defensive tools that defenders can inspect, adapt, and deploy across multi-vendor systems.