numbat – Endpoint Visibility and Forensics for AI Coding Agents
numbat is an open-source tool to monitor AI coding agents and rebuild their sessions.
Run Perplexity?
Get an email when a reviewed story names Perplexity, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
numbat is a new open-source tool from Perplexity that monitors AI coding agents like Claude Code, Codex, and Cursor. It hooks into these agents to normalize their activity into a single event model, allowing for detection rules to be run locally. The tool can rebuild sessions from stored evidence, identifying potentially malicious actions such as secret file reads followed by data exfiltration attempts.
The lesson from this incident
Full lessonAs AI coding agents like Claude Code, Codex, and Cursor gain widespread adoption in development environments, they introduce a novel and underappreciated attack surface: autonomous processes with broad filesystem, network, and credential access operating largely unmonitored. Without dedicated tooling, these agents can read sensitive secret files and exfiltrate data with no human-visible trail, making forensic reconstruction nearly impossible after the fact. The release of numbat highlights that traditional endpoint detection tools were not designed to normalize or interpret AI agent activity, leaving a critical visibility gap. This matters because AI agents frequently operate with developer-level privileges in environments containing source code, API keys, and cloud credentials — exactly the data most valuable to attackers. Treating AI agents as trusted black boxes without audit controls is a systemic security failure waiting to be exploited.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.