Perplexity open-sources Numbat to police what AI coding agents do

Numbat attaches to an agent at three points. It configures harness hooks, including pre-action hooks that can block execution before a risky command runs. It reads session logs and diagnostics straight off the local filesystem and normalizes them into an NDJSON timeline via numbat scan — which also means it can reconstruct sessions that predate its own installation. And it acts as an OpenTelemetry receiver through numbat collect, standing up a local server that listens on localhost so telemetry stays on the device unless an administrator ships it elsewhere.

The forensic angle is what separates this from conventional endpoint detection. EDR tools already watch processes and network traffic, but agent harnesses generate their own layer of evidence — tool-call records, hook events, model-driven action sequences — that a process monitor never sees. Numbat's normalized timeline is built to answer why an agent did something, not just that a command executed.

Numbat ships with 52 built-in rules across 11 behavior categories, written as CEL expressions over normalized events, and operators can add their own without touching Numbat's code. The rules that matter most are the multi-step ones: detections for privilege escalation, secret access, exfiltration and lateral movement. Those categories exist precisely because the danger lives in the sequence — reading a file, then calling an API, then editing a config can each pass inspection alone while forming an incident together.

For security teams, that reframes AI agents as a distinct endpoint concern rather than something the existing stack already covers. The practical starting point is inventory: knowing which coding and desktop agents employees run, where, and with what permissions, before deciding where harness-level blocking belongs.

Every capability here is a vendor claim. The only primary source is Perplexity's own launch and research writeup, with no third-party benchmarks comparing Numbat to EDR products, cloud security tooling or rival agent monitors. Open-sourcing the implementation lets teams read the code, but it doesn't validate the detection quality.

Coverage is the real variable. Numbat is only as good as what a given harness exposes — some agents offer strong pre-action blocking points, others may not, and organizations will have to verify the exact tools and configurations in their fleets rather than trust a general claim of support. There's a privacy operational load too: the session artifacts and transcripts Numbat collects can hold source code, internal plans, and secrets a developer accidentally handed to the agent, so any centralized log store needs tight access controls of its own. Whether this becomes a category or a curiosity depends less on the code than on whether agent vendors converge on common hooks, telemetry schemas and approval controls — because if every harness speaks a different dialect, defenders keep doing integration work no matter how many tools like Numbat ship.