{"id":144151,"date":"2026-08-18T22:09:22","date_gmt":"2026-08-18T22:09:22","guid":{"rendered":"https:\/\/www.europesays.com\/ai\/144151\/"},"modified":"2026-08-18T22:09:22","modified_gmt":"2026-08-18T22:09:22","slug":"perplexity-builds-guardrails-to-rein-in-rogue-ai-agents","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ai\/144151\/","title":{"rendered":"Perplexity Builds Guardrails to Rein in Rogue AI Agents"},"content":{"rendered":"

\n Agentic AI<\/a>
\n ,
\n Artificial Intelligence & Machine Learning<\/a>
\n ,
\n Next-Generation Technologies & Secure Development<\/a>\n <\/p>\n

Open-Source Numbat Blocks Agent Actions That Violate Enterprise Security Policies<\/p>\n

Emilia David<\/a> \u2022
\n August 18, 2026 \u00a0 \u00a0 <\/p>\n

\"Perplexity
\n Image: Shutterstock\/ISMG <\/p>\n

Now that cyberattacks by artificial intelligence agents gone rogue have left science fiction to become reality, the internet writ large is waking up to how much security enterprise agents need. <\/p>\n

See Also: Why Traditional DLP Can’t Keep Up With AI Data Growth<\/a><\/p>\n

Startup Perplexity AI saw the need for a tool to corral AI agents and prevent them from crossing security boundaries. It designed the open-source tool Numbat<\/a> – named after an animal with a long pointy nose for collecting bugs – to detect and block AI agents from stepping outside enterprise safety policies. Agents, even without prompt injection, often find ways around obstacles to complete tasks – as model repository Hugging Face can attest (see: When the Sandbox Won’t Hold: Lessons From Hugging Face<\/a>).<\/p>\n

Perplexity CISO Kyle Polley told ISMG that, like other enterprises, the company faces the same agentic security issues. It knew it needed a tool to stop agents from doing whatever they want. <\/p>\n

“Folks, especially due to recent events, are now waking up to the idea that agents can go rogue and they might not follow policies even if you add it to the system prompt,” Polley said. <\/p>\n

Perplexity began building the tool months before the Hugging Face incident. “It was very clear early on that agents will increasingly get more and more autonomy and access, which will expose the risk of them going rogue or bypassing soft guardrails,” he said. Polley said his team experimented with Numbat until “we were confident in its usefulness.” <\/p>\n

Numbat integrates with many widely used agent harnesses, which Perplexity said means security teams don’t need to build custom safeguards and monitoring tools for each agent. It has live monitoring and policy enforcement. If something goes wrong, companies can use Numbat tools for forensic reconstruction. <\/p>\n

The tool sits between when the agent starts to think about doing something and when it takes action. For example, if a user asks an agent with the correct permissions to look up data that might contain sensitive information and then send it somewhere else, Numbat steps in before the agent completes the task and checks whether it is allowed under the company’s security policies. If it is, then the action goes through. Security teams can then revisit the session to analyze it. <\/p>\n

Unlike the agents it’s supposed to observe, Numbat does not learn from its experiences. All of its knowledge comes from what enterprises build into it, so it can accurately judge whether an agent is going against policy. <\/p>\n

“This is by design as we wanted Numbat to have hard guardrails at its core,” Polley said. <\/p>\n

He added that for continuous analysis, the company points its agent platform, Perplexity Computer, to Numbat’s audit logs so it learns how internal systems operate and can detect suspicious activity. <\/p>\n

Numbat does this in three ways. It plugs into the hook subsystem that most coding agents already have. Numbat can evaluate actions before they run and compare what the agent plans to do against security policies. Hooks are deterministic points where action is paused to allow another program to run code. In this case, Numbat is a pre-action hook that runs before an action starts. <\/p>\n

Numbat then accesses and analyzes session artifacts from agent harnesses for forensic reconstruction. The tool reads the artifacts and converts these into a normalized NDJSON format, which security teams can download for local processing if they want. Numbat accesses the artifacts directly within the filesystem so that it gets data “in its most usable and pristine form.” <\/p>\n

The company said in a blog post that coding agent users are already accustomed to downloading session transcripts for later analysis. Still, those transcripts are often in plaintext, “which is ill-suited for security teams who require machine-readable logs with a consistent, predictable schema.” <\/p>\n

The third integration lets Numbat run a local OpenTelemetry receiver. By running a command on Numbat, it starts a server where coding agents send information for downstream analysis. Since this is a local receiver, telemetry stays on the device unless the security team brings it elsewhere. <\/p>\n

Perplexity uses Numbat internally to secure code its engineers generate and review with platforms like Claude Code, Codex, OpenCode and Pi. The company said it created, and eventually shipped along with the open-source Numbat tool, 52 rules which are categorized into 11 behavior types and a set of multi-step sequences. These include detecting secret access, exfiltration, privilege escalation and lateral movement. <\/p>\n

The company said it added sequence correlation skills to Numbat because it learned that some individual commands in the agent code often don’t look malicious. But taken as a whole sequence within a session, Numbat can see that the agent was attempting to break rules like secrets management. <\/p>\n","protected":false},"excerpt":{"rendered":"Agentic AI , Artificial Intelligence & Machine Learning , Next-Generation Technologies & Secure Development Open-Source Numbat Blocks Agent…\n","protected":false},"author":2,"featured_media":144152,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[405,7537,7525,7519,1670,7522,1393,313,1557,7523,7526,7520,7515,7521,4770,7507,3165,7516,7514,7508,7511,7513,7512,7510,7509,7524,7517,3805,4036,2112,7518,4862],"class_list":["post-144151","post","type-post","status-publish","format-standard","has-post-thumbnail","category-agentic-ai","tag-ai-agents","tag-artificial-intelligence-agents","tag-business-continuity","tag-clinger-cohen-act","tag-congress","tag-coso","tag-cyber-security","tag-cybersecurity","tag-defense-department","tag-diacap","tag-disaster-recovery","tag-e-government-act","tag-energy-department","tag-fiscam","tag-government-accountability-office","tag-government-information-security","tag-hipaa","tag-homeland-security-department","tag-identity-theft","tag-information-security","tag-information-security-articles","tag-information-security-events","tag-information-security-news","tag-information-security-webinars","tag-information-security-white-papers","tag-legislation","tag-national-security-agency","tag-nist","tag-office-of-management-and-budget","tag-risk-management","tag-us-cert","tag-white-house"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/144151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=144151"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/144151\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/144152"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=144151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=144151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=144151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}