Numbat gives agent security teams 52 built-in rules across coding harnesses

Agent controls move onto the endpoint

AI coding agents now execute commands, read files, call tools, and work across long sessions. Perplexity’s July 29 X post introduced Numbat as an open-source response to that risk: "an agent-detection and response layer that is designed to work across agent harnesses". The tweet says Numbat gives security teams visibility into agent activity and controls to block selected actions before execution.

The linked research post is more concrete than the tweet. Numbat is a lightweight static Go binary for macOS, Linux, and Windows. It integrates with agent harnesses through hooks, session artifacts, and OTLP telemetry. Hooks can run before an agent action and block risky operations. Session artifacts let defenders reconstruct older runs from files stored under agent-specific directories. OTLP collection lets a local receiver gather telemetry without sending data off-device by default.

Perplexity’s account usually posts product features, research notes, and infrastructure work around search and agentic systems. This release is notable because it treats AI agents as endpoint security subjects, not just model prompts. Perplexity says it uses Numbat internally for client-side coding agents including Claude Code, Codex, OpenCode, and Pi.

The sharpest number is 52 built-in rules across 11 behavior categories. The post names detections for secret access, exfiltration, privilege escalation, and lateral movement. One example rule detects sudoers tampering, including writes to sudoers policy and attempts to install NOPASSWD grants. Another correlates a secret-manager read with a later data-bearing curl or wget request, because either action alone may be legitimate while the sequence deserves investigation.

What to watch next is whether Numbat becomes a common control layer across companies running multiple coding agents. The source tweet is on Perplexity’s X account, and the code is linked from the Numbat research post.