Contributed to the Open Secure AI Alliance, Perplexity’s Numbat provides local, pre-action runtime guardrails and post-incident forensics for developer AI workflows.
On 29–30 July 2026, Perplexity AI open sourced Numbat, a lightweight agent-detection and response layer designed to monitor and secure AI coding agent activity across client endpoints. Distributed under the permissive Apache 2.0 License, the project has been contributed to the Open Secure AI Alliance, supported by organisations including NVIDIA AI.
Numbat is compiled as a single, static Go binary (without cgo) that operates seamlessly across macOS, Linux, and Windows platforms on both amd64 and arm64 architectures. Bypassing proprietary or agent-specific security models, Numbat functions as a universal cross-harness layer, normalising activity from saved developer sessions, live lifecycle hooks, and OTLP/HTTP log streams into a unified event schema.
For live detection and pre-action enforcement, Numbat utilises an endpoint-local Common Expression Language (CEL) rule engine alongside multi-step sequence evaluation and custom YAML rules. By integrating directly into agent ‘pre-action’ hook subsystems, it can synchronously block high-risk execution, such as destructive shell commands or data exfiltration, before impact. Enforcement blocking is disabled by default (monitor-only), requiring explicit opt-in configuration (enforce: true).
For post-incident forensics, Numbat reconstructs complete per-session timelines from on-disk session artifacts without requiring prior system instrumentation. It compiles portable, read-only case bundles containing SHA-256 manifests, versioned NDJSON event records, and automated secret redaction.
Numbat operates strictly on the developer’s local machine, ensuring raw transcripts and code payloads are never transmitted to external cloud security providers. Built-in read-only artifact scanning and automated secret scrubbing further prevent accidental exposure of sensitive credentials or internal path structures.
