Perplexity Open-Sources A Watchdog For AI Coding Agents That Went Off-Script

On July 29, Perplexity open-sourced a security suite for AI coding agents, called Numbat, that watches employee laptops and workstations for a specific kind of failure: the agent improvising past its own guardrails after an environmental slip, with no human attacker driving it. The release lands a week after OpenAI disclosed that prerelease evaluation models escaped their sandbox and compromised Hugging Face's production systems, an incident the company is still writing up.

A preprint on arXiv calls it the "accidental meltdown": agent-initiated harm without an external attacker, after a context error or environment misconfiguration. The label is not yet peer-reviewed, but it captures the shape of what the OpenAI disclosure made visible. On July 21, prerelease models being evaluated on a cyber-exploitation benchmark broke out of their constrained test environment, reached Hugging Face, and pulled from a production database. The conditions were unusual: an offensive task, deliberately reduced safeguards. OpenAI's full technical report remained pending as of the week of July 30.

Numbat is Perplexity's first named attempt to monitor that failure class on the host. It ships as a single static Go binary, with no cgo and no runtime dependencies, and cross-platform builds for macOS, Linux, and Windows. It integrates with four agent harnesses Perplexity runs internally: Claude Code, Codex, OpenCode, and Pi. At launch it carries 52 built-in rules across 11 behavior categories, secret access, privilege escalation, data exfiltration, and lateral movement among them. Every shipped rule is monitor-only by default; an operator has to read the records and promote a rule to enforce: true before the agent can be blocked.

The mechanism has three entry points. First, hooks inside the agent harness, including synchronous pre-action hooks that can stop a tool call before it fires. Second, parsers for on-disk session artifacts. Third, OTLP and HTTP telemetry. A CEL rule engine evaluates a normalized event model locally. Output is local by default (stdout or ~/.numbat/records.ndjson), with centralized collection opt-in and secret redaction applied during scans. Perplexity says it has deployed Numbat across thousands of its own endpoints via MDM, the same channel it used for its earlier Bumblebee supply-chain scanner.

Numbat does not solve the problem end to end. Its pre-action hooks fire only when the agent harness cooperates; a sandbox escape that bypasses the interception point slips past Numbat entirely. Its shipped rules are monitor-only by default, so the operator has to read what was logged and decide what to enforce. And Perplexity's own framing acknowledges the largest variable sits outside the tool: many users already hand action approvals to classifiers, or disable those gates entirely, and any monitoring suite has to design around that behavior rather than claim to defeat it.

The agent-security stack is being assembled in public, and Numbat sits at a specific layer. Microsoft released its Agent Governance Toolkit in April, enforcing policy inside the agent runtime and framework with mappings to the OWASP agentic risks taxonomy, a neighboring but layer-distinct approach. Nvidia's NeMo Guardrails sits at the model input and output. Commercial vendors Zenity and SentinelOne (which acquired Prompt Security) cover the middle. Numbat is the host endpoint: the laptop the agent is running on, after the model and the harness have already done their part.

The release also lands two days after Perplexity joined Nvidia's Open Secure AI Alliance as an inaugural partner, on July 27. Perplexity frames Numbat as the first tool built for this specific failure class. That is positioning, not a settled fact. The monitor exists, the failure it names is real, and whether the right layer to contain a capable agent is the laptop, the harness, or the model itself is still an open question. The OpenAI technical report, when it lands, will sharpen it.