Meet Numbat: Perplexity’s open-source tool to track rogue AI agents
AI agents can now act on their own, but who is watching them? Perplexity’s Numbat helps security teams monitor, investigate and block risky actions.
AI agents are getting more freedom at work, and it makes them harder to supervise. Perplexity has built Numbat, an open-source security suite designed to help defenders track, investigate and stop risky actions by AI agents before they turn into larger security incidents.
The tool was recently spotlighted by Perplexity CEO Aravind Srinivas, who said detecting malicious intent and carrying out forensic checks will become crucial as rogue agents grow more capable. His comments come amid rising concern over agents escaping sandboxes and attacking third-party sites.
Why AI agents need closer monitoring
AI agents are software systems that can take actions, not just answer questions. At work, they may write code, run commands, read files, connect to internal tools or interact with external services. That makes agents useful, but it also creates a new security risk.
Perplexity says many enterprises now run agents directly on client endpoints, including desktops, command lines and coding environments. These agents may have access to sensitive company systems and data. Some can also operate for hours or days. Users may even bypass approval prompts to make them faster.
Numbat is designed to give security teams visibility across this growing network of agents and MCP servers. Different teams can use different tools and configurations, making it difficult to monitor everything separately. Numbat provides a common layer for detection and response.
How Numbat tracks agent activity
Numbat monitors activity across desktops, command-line tools, IDEs and gateways. It collects signals through local hooks and plugins, OTLP/HTTP telemetry logs and on-disk session files. Security teams can use these records to reconstruct what an agent did during a session.
The tool follows a local-first approach, so activity can remain on the device by default. Administrators can also choose to process logs locally or send structured telemetry to central systems for deeper analysis.
Numbat includes 52 built-in rules across 11 behaviour categories.
These cover risks such as secret access, data exfiltration, privilege escalation, reconnaissance, lateral movement, persistence and tampering. For example, an agent could try to access secrets and then send data outside the system. Numbat can flag that sequence as suspicious.
Where enterprises could use it
Numbat also supports forensic timelines. These help security teams understand the order of actions during an incident. This matters because not every agent-related incident requires an external attacker. A badly configured or overly autonomous agent can create a serious security problem on its own.
Perplexity says it uses Numbat internally across its own endpoints. This includes client-side coding agents such as Claude Code, Codex, OpenCode and Pi. The company has also positioned Numbat within the wider defender ecosystem. Perplexity is a member of the Open Secure AI Alliance alongside NVIDIA and other organisations.
Numbat is built in Go and works on macOS, Linux and Windows. It can run as a standalone binary or through Go. Enterprises can also deploy it through managed configurations and MDM systems.
Numbat does not remove the need for careful AI governance. It gives security teams another layer of visibility and control as agents gain access to more systems.