Perplexity Numbat Complete Guide 2026: The Open-Source Security Layer That Visualizes & Blocks AI Agent Actions

---

"Are you leaving AI agents unsupervised, with no idea what they're doing on their own?"

On July 29, 2026, Perplexity open-sourced Numbat under Apache 2.0. It's a security layer that makes AI agent activity visible and blocks dangerous operations before execution.

Based on Perplexity's official announcement and the GitHub repository (perplexityai/numbat) README, this article explains who Numbat is, what it can do, and how to get started — in a beginner-friendly way.

After reading this article you'll know:

• What problems Numbat solves with "monitoring, detecting, and blocking AI agents"
• Which agents it supports (Codex, Claude Code, OpenClaw, etc.) and what dangerous behaviors it detects
• How to go from installing a single Go binary to monitoring
• The "detection flywheel" of alert → block → analyze
• Why security teams should evaluate it now

---

What Is Numbat? (3 Lines)

Numbat is a security layer that monitors, detects, and blocks AI agent activity.

• See everything agents did (live & retroactively)
• Block dangerous operations before execution (rule-based)
• Runs instantly as a single Go binary (macOS/Linux/Windows)

Perplexity open-sourced what it actually uses internally, under the Apache 2.0 license.

---

Why It's Needed (Background)

In 2026, AI agents that directly access terminals and file systems — Claude Code, Codex CLI, OpenCode, and others — are exploding in popularity.

The problem: these agents can:

• Read SSH keys
• Delete files
• Extract API keys from environment variables
• Fetch cloud metadata

Almost no mechanism existed to even "know" what they did.

Numbat fills this "agent visibility gap."

---

What It Can Do (Feature List)

All features from the GitHub README:

---

Supported Agents & Detectable Dangerous Behaviors

Supported Agents

• Codex CLI (OpenAI)
• Claude Code (Anthropic)
• OpenClaw
• OpenCode
• And other terminal/file-system agents

Dangerous Behaviors It Detects

---

How to Get Started

1. Install (Single Go Binary)

go install github.com/perplexityai/numbat/cmd/numbat@latest

2. Start Monitoring

numbat --config numbat.yaml

3. Write Rules (YAML + CEL)

rules:
  - name: "Block SSH key reads"
    description: "Prevent agents from reading SSH private keys"
    match: |
      action == "read" && path.matches(".*\.ssh/.*id_rsa.*")
    action: block

Alert → Block → Analyze (Detection Flywheel)

---

FAQ

Q1. Which agents are supported?

Codex CLI, Claude Code, OpenClaw, OpenCode, and other terminal/file-system agents.

Q2. What's the detection mechanism?

Hook-based, lightweight. With blocking enabled, pre-action hook latency is added.

Q3. Does it send data externally?

No. All detection is local — no external transmission.

Q4. Can I create my own rules?

Yes. Freely create rules with CEL-based YAML.

Q5. Where do alerts go?

Choose from stdout, local files, or HTTP delivery.

Q6. What is "Computer"?

Perplexity's internal analysis system. All features work with Numbat standalone.

Q7. Can I try it right now?

go install github.com/perplexityai/numbat/cmd/numbat@latest and run.

---

Summary — Numbat Is a "Security Essential for the Agent Era"

Bottom line: Numbat brings visibility to the "invisible operations" of the exploding number of AI agents — one of the most important security OSS projects of 2026.

• Multi-agent support (Codex, Claude Code, OpenClaw, etc.)
• Local detection (no external transmission)
• Pre-execution blocking (enforce rules)
• Single Go binary (instant deployment)
• Apache 2.0 (completely free)

Conversely, these people don't need to rush:

• You don't use AI agents internally yet
• Agent permissions are minimal and risk is low

Numbat is Perplexity's "battle-tested in production" tool open-sourced as-is. In the era where agents write code, touch files, and access the cloud — it's becoming an essential layer for monitoring those "invisible operations."

"From today, your AI agents are under surveillance."

Numbat visualizes agent behavior and stops danger before execution. That's the new security standard of 2026.

---

Information in this article as of July 30, 2026. Based on Perplexity official X (@perplexity_ai) and the GitHub perplexityai/numbat README.