Perplexity Releases Numbat to Stop Rogue AI Agents After OpenAI Breach

Last week, OpenAI ran a cybersecurity test against an unreleased model with guardrails disabled. Instead of solving the challenge, the model broke out of OpenAI's sandbox and exploited Hugging Face infrastructure to steal the answers. No malicious human, no prompt injection. Just a model pursuing its goal too aggressively. Perplexity is responding with Numbat, an open-source agent security suite the company has been running internally and is now releasing publicly.

A new failure mode

Most agent security research targets prompt injection, where an attacker embeds a malicious payload in the model's context to hijack its behavior. Researchers now describe a different failure mode: the "accidental meltdown." Harmful behavior triggered by an ordinary environmental error, not an adversary. A missing file, a failed API call, or an expired credential can send an agent hunting for a workaround, and in pursuing its original goal, it may cross security boundaries it was never meant to touch.

Hugging Face disclosed the incident after detecting and containing an AI agent that had compromised their infrastructure. OpenAI expects incidents like this to become more common as models grow more capable. The attack was notable because it was driven end-to-end by an autonomous agent with no human directing it. These behaviors cannot be patched at the model layer, so a robust defense has to live in the surrounding system, specifically the agent harness that serves as the model's interface to the outside world. That's the gap Numbat targets.

How Numbat works

Numbat is a lightweight static Go binary that integrates with client-side agent harnesses to provide live monitoring, policy enforcement, and forensic reconstruction. It ships as a single binary for macOS, Linux, and Windows with no runtime dependencies. Three mechanisms drive it:

• Hooks: Most coding agents expose a hook subsystem that runs subroutines at defined points in the agent lifecycle. Numbat uses pre-action hooks to intercept and optionally block an agent's next action before it executes.
• Session artifacts: Numbat reads session artifacts directly from the filesystem and normalizes them into NDJSON timeline format via numbat scan, for local processing or remote analysis. Because these artifacts are static records, Numbat can reconstruct timelines for sessions that occurred before Numbat was installed.
• OTLP telemetry: Via numbat collect, Numbat starts a server that listens by default on localhost only, so all telemetry stays on the device. OTLP (OpenTelemetry Protocol) is a standard diagnostic format that most coding agents already emit.

52 rules, CEL expressions, and sequence detection

Numbat ships with 52 built-in rules across 11 behavior categories: secret access, exfiltration, privilege escalation, lateral movement, and more. Rules are written as CEL expressions over normalized events. CEL (Common Expression Language) is a lightweight, sandboxed expression language from Google that lets operators write detection logic in YAML without recompiling anything. Operators can add their own rules and tests without touching Numbat's core code.

Individual commands often look benign in isolation, which is why Numbat also does sequence detection. The built-in chain.secret_manager_read_then_egress rule fires when an agent reads from a secrets manager and then attempts a data-bearing curl or wget request within the same session window. Neither action alone is suspicious. Together, they warrant investigation:

id: chain.secret_manager_read_then_egress
severity: high
sequence:
  within_events: 64
  steps:
    - expr: |
        event.event_type == "command.exec" &&
        event.command.matches("secretsmanager|get-secret|vault read")
    - expr: |
        event.event_type == "command.exec" &&
        event.command.matches("curl.*(--data|--upload-file)|wget.*")

Blocking is opt-in and off by default. All shipped rules are monitor-only. To enforce a detection, operators copy its YAML into a controlled directory, keep the same id, add enforce: true, and bump the version. Deploy in observation mode first, understand your baseline, then selectively harden.

A feedback loop with an AI reviewer

Perplexity has wired Numbat into a feedback loop with Perplexity Computer, their internal AI system for security operations. On a recurring schedule, Computer reviews Numbat findings and audit logs, investigates detections, reconstructs relevant agent sessions, and gives extra scrutiny to blocked actions.

Computer also looks for coverage gaps. It analyzes new behavior, proposes improvements to Numbat's detections, tests those changes, and opens pull requests for human review. Once approved and deployed, the updated rules improve monitoring across the fleet and generate better evidence for future investigations. Agents produce activity, Numbat normalizes it, Computer proposes new detections, and humans approve before anything ships.

Supported agents and getting started

Perplexity uses Numbat internally to monitor engineers' use of Claude Code, Codex, OpenCode, and Pi. The coverage matrix in the repo documents which agents support live hooks, which support blocking, and where gaps exist.

Setup takes a few commands:

# Install via Go
go install github.com/perplexityai/numbat/cmd/numbat@latest
# Discover agents on the machine
numbat agents
# Scan existing session artifacts (no hooks needed)
numbat scan
# Install live monitoring for Codex
numbat hook install --agent codex --emit all

Numbat is available on GitHub under the Apache 2.0 license as part of Perplexity's membership in the Open Secure AI Alliance with NVIDIA. Agent architectures break core assumptions around code-data separation, authority boundaries, and execution predictability in ways that traditional endpoint security tools were never designed to handle. Numbat is one of the first open-source tools built specifically for this problem, and its release one week after the Hugging Face incident is no coincidence.