Perplexity’s Aravind Srinivas Open-Sources Numbat, a Tool to Catch AI Agents Going Rogue

Aravind Srinivas doesn’t usually sound worried on X. This week, he did.

On September 5, the Perplexity CEO pointed to Numbat, an open-source tool that tracks AI agents, and framed it as urgent. He said detecting malicious intent in agents and doing forensics is becoming crucial given recent cases of rogue agents escaping sandboxes and hitting third-party sites. Coming from someone who’s spent the last year pushing Perplexity deeper into agentic territory, that’s not a throwaway line.

What Numbat actually does

Numbat isn’t a new product launch. Perplexity first released it publicly at the end of July, and Srinivas’s tweet is really a re-highlight, timed to a moment when agent security has stopped being a hypothetical concern.

The tool monitors AI agents running on desktops, command lines, IDEs, and gateways, collecting activity through local hooks and plugins. It also records information through OTLP/HTTP logs and local session files that can be used for investigations. Everything gets normalised into a common event format, and Numbat can flag or block actions using rules written in Common Expression Language (CEL). It ships as a single static Go binary for macOS, Linux, and Windows, and it’s genuinely free, released under the Apache 2.0 license.

Perplexity says it built 52 detection rules across 11 behaviour categories, covering things like secret access, data exfiltration, privilege escalation, and lateral movement. The interesting part is sequence correlation: a single command an agent runs might look completely harmless, but a chain of them within one session can reveal that the agent was quietly trying to get around a security rule. Numbat is built to catch that pattern, not just the individual step.

Perplexity’s own security team uses it internally to keep an eye on code its engineers generate with Claude Code, Codex, OpenCode, and other agent harnesses.

Read More: Perplexity CEO Says AI Browser Set to Erase These Top Office Roles

Why Srinivas is pushing this now

This isn’t Perplexity’s first open-source security release this year. Back in July, the company put out Bumblebee, a read-only scanner for risky packages and AI tool configs on developer machines, and BrowseSafe, a benchmark for testing whether browser agents can be tricked by prompt injection on the sites they visit. Around the same time, Srinivas referenced the Hugging Face breach as a case study: when the platform got compromised, its closed-source security tools reportedly couldn’t tell attackers apart from the defenders trying to contain the damage, and the company ended up running an open-weight model on its own infrastructure just to do the forensics.

That’s the pitch behind Numbat too. Closed, opaque agent tooling is hard to audit when something goes wrong. An open one, at least in theory, lets a security team actually see what happened, step by step.

Read More: An AI Startup, Rillet, Just Raised $100M in 48 Hours. Here’s What It Says About the Future of Hiring

Why this matters if you’re running agents in an Indian startup

Founders don’t need convincing that AI agents are useful. Coding agents, research agents, and support agents are already stitched into a lot of early-stage Indian stacks, often with real access: reading repositories, touching credentials, executing commands, sometimes running unattended for hours. Very few teams outside dedicated security functions are watching what those agents are doing session by session.

That gap is exactly what Numbat is built for, and the fact that it’s free changes who can realistically use it. A well-funded enterprise can build its own agent monitoring layer. A ten-person startup shipping fast with Claude Code or a Codex-style harness usually can’t, and mostly doesn’t try. An open-source tool that a founder or a single security-minded engineer can install in an afternoon is a meaningfully lower bar.

There’s also an Indian-origin angle worth noting here. Srinivas was born in Chennai, studied electrical engineering at IIT Madras, and went on to a PhD at UC Berkeley before co-founding Perplexity in 2022. He was named India’s youngest billionaire in the 2025 Hurun list. His decision to build Perplexity’s security tooling in the open, rather than keep it proprietary, is a pattern Indian founders scaling their own AI products can watch closely, not just for the tool itself, but for how a company balances speed with the discipline to build guardrails alongside it.

The bigger picture is that AI agent security is turning into its own category, fast, and most of the early tooling is coming out of companies that got burned or nearly burned first. Numbat won’t be the last release like this. It’s a reasonable bet that more agent-heavy startups, in India and elsewhere, start treating “how do we monitor our own agents” as a launch-week question instead of an afterthought.

If your team is running AI agents in production right now, Numbat is worth at least a look this week, install it read-only first, see what it surfaces, and decide from there whether you need enforcement mode.

FAQs