Perplexity has open-sourced Numbat, a security suite designed to watch what AI agents actually do on your machines and stop dangerous actions before they happen – and that’s a big deal for anyone taking agentic AI seriously in 2026. Instead of yet another abstract “AI safety” whitepaper, this is the guts of Perplexity’s own internal agent defense layer, shipped as an Apache 2.0 Go binary you can run on macOS, Linux, and Windows.

If you’ve been following the AI agent wave over the last year, you’ve probably noticed the gap between the demos and the reality of deploying this stuff in production. Agents that can browse, write code, manage files, and call arbitrary tools are incredibly powerful – but from a security team’s perspective, they look a lot like an automated intern with root access and no sense of self-preservation. That’s the context Numbat drops into.

Perplexity describes Numbat as an “agent-detection and response layer” that works across different agent harnesses – desktop apps, CLIs, IDE assistants, and gateway-style agents. In practice, you can think of it more like an EDR (endpoint detection and response) system for AI agents: Numbat sits on the endpoint, observes what agents are doing, and enforces policy locally, instead of trusting whatever the model decides to output.

That “on the endpoint” part matters. Most of the early “LLM security” products focused on prompts, guardrails, and scanning input/output at the API or reverse-proxy layer. Useful, but limited. Modern attacks often don’t show up as obviously malicious text – they show up as the downstream effect of that text when the agent starts running tools, modifying files, or hitting internal APIs. A 2026 report on LLM security trends notes that incidents are increasingly tied to “emergent behavior rather than discrete vulnerabilities”, and stresses that tools exposed to LLMs must be treated like privileged interfaces with independent controls and auditing. Numbat is very much a product of that mindset.

Architecturally, Numbat is a single Go binary that you can deploy on macOS, Linux, or Windows, and it’s designed to be run by security teams as a standard endpoint component. It ingests signals from several sources: lifecycle hooks and plugins in agent frameworks, OpenTelemetry or HTTP logs, and session artifacts left on disk by IDEs, CLIs or local tools. Perplexity’s coverage docs list integrations for popular coding and agent tools like Claude Code, Codex-style agents, Gemini CLI, Cursor, Windsurf, GitHub Copilot CLI and others, so the idea is that Numbat can reconstruct what an “AI session” actually did, rather than just what was typed into a prompt box.

That reconstruction is one of the more interesting aspects. Perplexity says Numbat supports forensic reconstruction of agent sessions from existing artifacts, which means even if you didn’t have perfect hooks in place at runtime, you can still analyze what happened after the fact. For security teams dealing with “AI agent did something weird last night” incidents, being able to replay an agent’s actions without fully reproducing the environment is a major quality-of-life upgrade.

On the proactive side, Numbat exposes live monitoring and pre-action blocking. Perplexity’s announcement highlights that security teams can see agent activity in real time and selectively block actions before they execute. That could be anything from preventing an agent from running a dangerous shell command to blocking access to a particular directory, API, or external service based on policy. It’s similar in spirit to how traditional EDR products intercept syscalls or process behaviors – but tuned for the patterns of AI agents rather than human-driven sessions.

Numbat is also part of a larger internal feedback loop at Perplexity. The company recently wrote about “Computer,” its orchestration layer that coordinates tools and agents, and described a four-layer defense architecture with open-source components like BrowseSafe for browser agent security. In their Numbat announcement, Perplexity says the telemetry Numbat generates is fed into Computer, which continuously analyzes the data, escalates suspicious behavior, and proposes new on-device detections – essentially a detection flywheel where each incident improves the rules running on endpoints. Open-sourcing Numbat makes that on-device piece accessible to the broader ecosystem, even if the full Perplexity stack remains proprietary.

The timing of the release is not accidental. Over the last year, we’ve seen a steady drumbeat of concern around “excessive agency” and insecure plugin design, including in the OWASP Top 10 for Large Language Model Applications, which explicitly calls out risks from giving LLMs too much power over tools and systems without adequate guardrails. Security vendors and researchers have also been surveying the landscape: recent analyses of LLM security in 2026 emphasize that effective programs focus on runtime behavior and continuous validation, rather than one-time configuration or static prompt filters. Numbat slots neatly into that philosophy by anchoring security to what happens on real machines.

Perplexity itself has been steadily positioning around open-source security for agents. Earlier this year, the company made noise with tools like Bumblebee, a security scanner aimed at protecting developers from malicious dependencies and risky local configurations. In July, it also detailed how its “Computer” system bakes security into agent orchestration from the ground up, including third-party audits and defense-in-depth around browser and tool access. By open-sourcing Numbat under an Apache 2.0 license, Perplexity is effectively taking one of its internal control layers – something that already runs across its own systems – and inviting the rest of the industry to adopt, audit, and extend it.

One subtle but important aspect is that Numbat is designed to be vendor-agnostic. Perplexity’s launch thread on X stresses that it “works across agent harnesses,” not only Perplexity’s own agents. That’s a smart move: enterprises are already in a multi-model, multi-vendor world, mixing services from OpenAI, Anthropic, Google, Perplexity, and homegrown models. A security layer that only works with one provider is a hard sell. A Go-based endpoint binary that just cares about agent behavior on the machine – and can read telemetry and artifacts from many tools – fits better with how security teams already think about EDR, SIEM, and SOC workflows.

Zooming out, Numbat also arrives in a competitive market for “LLM security tools,” but most of that market is still focused on API firewalls, prompt filters, and data loss prevention in the cloud. Those products monitor what goes into and comes out of the model, enforce policy on prompts, redact sensitive data, and sometimes inject their own guardrails on the fly. What they typically don’t see is the agent’s behavior on the endpoint – the actual shell commands, file writes, or IDE actions. That blind spot is where Numbat is staking out territory.

It also aligns nicely with emerging best practices. Security guidance in 2026 keeps coming back to the same pattern: treat all context sources as untrusted, treat LLM tools as privileged interfaces, and focus on behavior instead of just configuration. Prompt injection remains a common initial vector, but the real damage happens later – when an injected instruction causes an agent to, say, exfiltrate a repo, change CI scripts, or phone home to an attacker-controlled endpoint. By giving teams on-device visibility plus the ability to intercede before actions execute, Numbat is trying to catch that second stage.

For developers and security engineers, the open-source angle matters beyond just cost. Having access to the code means you can adapt Numbat to your own agent stack, plug in your internal logging formats, add custom detections, and even contribute upstream if your use cases are more exotic. It also makes it easier for third-party auditors and researchers to stress-test the approach, build companion tools, or integrate Numbat into larger open ecosystems around agent frameworks and security standards.

There’s also a cultural shift embedded in this release. For years, AI companies treated security as something they would handle “behind the curtain,” often summarizing defenses in vague marketing language. Perplexity’s decision to open-source core pieces of its defensive stack – from BrowseSafe for browser agents to Numbat for endpoints – suggests a different approach: assume agents will be everywhere, assume security teams will want their own controls, and publish the primitives they can build on. It’s a move that also raises the bar for other players in the agent space.

Of course, Numbat is not a silver bullet. It doesn’t replace secure plugin design, robust access control, careful scoping of what agents can do, or all the usual fundamentals that OWASP and others keep highlighting. What it does offer is a practical, deployable way to bring agent behavior into the same visibility and control plane that enterprises already use for human activity on endpoints. In an era where “your AI” can now run shell commands and edit production code as easily as it writes emails, that feels less like a nice-to-have and more like table stakes.

For now, Numbat gives security teams a concrete starting point: a Go binary, a GitHub repository, and a set of integrations that show how to wire agent telemetry into a real detection and response loop. How far it goes from here will depend on whether the broader agent ecosystem rallies around shared tooling – but as a signal of where Perplexity thinks agent security needs to go, open-sourcing Numbat is clear enough.