Perplexity Open-Sources Numbat to Govern AI Coding Agents at the Endpoint

Perplexity has released Numbat, an open source agent security suite built to detect, prevent, and investigate risky behavior from AI coding agents running on client endpoints. The tool works across macOS, Linux, and Windows and ships as a lightweight, static Go binary that plugs into leading client-side agent harnesses. Numbat combines live monitoring, policy enforcement, and forensic reconstruction into a single layer that sits between an AI agent and the actions it attempts to carry out on a machine.

How Numbat Watches Agent Behavior

Numbat integrates with an agent harness through three points of contact: hooks, session artifacts, and OTLP telemetry. The hook mechanism drives how the tool intervenes. Hooks are deterministic points where an agent’s action pauses so another program can run code, and Numbat installs itself as a pre-action hook that checks what an agent plans to do against security policy before the action starts.

Session artifacts give Numbat its forensic reach. The tool pulls these artifacts directly from the filesystem, typically from an agent-specific directory under the user’s home folder, and normalizes them into a timeline through a command called “numbat scan.” Because the artifacts are static, self-contained records, Numbat can rebuild a session timeline even for activity that happened before the tool was installed on a given machine.

The third integration point, a local OpenTelemetry receiver, keeps monitoring data close to the source. Coding agents send information to this receiver for downstream analysis, and because the receiver runs locally, telemetry stays on the device unless a security team chooses to move it elsewhere.

Detection logic runs on top of these inputs through 52 built-in rules organized into 11 behavior categories, along with multi-step sequence detections covering secret access, exfiltration, and privilege escalation, among other risk patterns. The sequence detections close a specific gap: individual commands inside an agent session often look harmless in isolation, but analyzed as a full sequence, they can reveal an agent working around rules such as secrets management. Rules run as CEL expressions over normalized events, and operators can write and test their own rules without altering Numbat’s underlying code.

This kind of pre-action checkpoint resembles a familiar pattern in SAP environments, where segregation of duties and governance, risk, and compliance controls stop a sensitive transaction before it posts. Numbat’s rule engine and sequence detection were purpose-built for coding agent sessions, and SAP security teams will recognize the same instinct: catching an action before it completes.

From Internal Tool to Open Ecosystem Contribution

Perplexity built Numbat first to solve its own problem. The company uses the tool internally to secure engineers’ use of client-side coding agents, including Claude Code, Codex, and OpenCode, among other agent harnesses. Numbat is deployed across Perplexity’s fleet through mobile device management, with each instance recording agent activity locally and forwarding structured telemetry into centralized security systems. A team the company calls Perplexity Computer reviews recent Numbat findings and audit logs on a recurring schedule to catch suspicious or malicious behavior.

Having proven the approach internally, Perplexity now offers Numbat to the broader defender community as part of its membership in the Open Secure AI Alliance, a group that includes NVIDIA among other organizations. The company describes the release as removing a specific burden from security teams: instead of building custom safeguards for each individual coding agent in use, a team can adopt one integration layer that already understands multiple harnesses.

Consolidating oversight of multiple AI coding agents behind one monitoring layer follows a familiar instinct for SAP security teams, many of which already rely on consolidated SIEM platforms and centralized logging to track activity across systems.

What This Means for SAPinsiders

• Agent oversight shifts to the execution layer. Security teams evaluating AI coding agents should expect governance to live in the harness and endpoint layer, not just in the underlying model. Session logs and action sequences become the primary focus of agent risk reviews going forward.
• Open source release lowers the evaluation bar. Because Numbat is open source, SAP-adjacent security and IT teams can test its rule engine and hook integration directly, without relying solely on vendor claims. Teams can run proof-of-concept work internally before any procurement conversation begins.
• Fewer bespoke tools per coding agent. Teams currently building custom monitoring for each AI coding assistant may be able to consolidate that effort behind one cross-harness layer. Adopting a shared oversight layer reduces the staffing overhead of maintaining separate safeguards as engineering teams add more coding agents.