Numbat monitors agents before they exceed their permissions

Numbat blocks dangerous agent commands on macOS, Linux, and Windows. How this open-source suite secures local script execution.

Designed to secure agents installed on workstations, Numbat is an open-source suite capable of detecting, blocking, and analyzing actions deemed dangerous on macOS, Linux, and Windows. Perplexity specifically targets programming agents that can access local files, execute commands, use credentials, or interact with internal services.

The risk does not solely come from an attack or a malicious instruction. An agent can also cause an incident by going too far to find a solution to an ordinary task. Faced with a missing file, denied access, or an unavailable API, it may attempt to modify permissions, search for secrets, or bypass a restriction to achieve the set goal. Numbat intervenes around the model to control what it actually does on the machine.

The suite integrates directly into the agents' execution environments. Controls placed before each action can prevent a sensitive command, while session logs allow for the reconstruction of the complete sequence of an incident. Telemetry remains local by default and can then be sent to the security tools chosen by the company.

Numbat includes 52 rules divided into 11 categories. They notably cover access to secrets, privilege escalation, data exfiltration, and lateral movement between systems. The tool also analyzes sequences of actions: reading a secret may be legitimate, as is an outbound request, but their succession during the same session can trigger an alert.

Perplexity already uses Numbat on several thousand workstations to oversee Claude Code, Codex, OpenCode, and Pi. Detected incidents are then reviewed by Perplexity Computer, which can propose new rules subject to human validation before their integration. The project is available as open source and joins the work of the Open Secure AI Alliance.