Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-30 · high
The Apache-licensed tool ships 52 rules across 11 threat categories but leaves every one in monitor-only mode by default.
Why now: Numbat tagged v0.1.1 on July 29, the day before this story ran.
Perplexity released numbat, an open-source detection layer for coding agents, on July 29, per the project's GitHub repo.
Anyone running Claude Code, Codex, OpenCode, or Pi unattended is exposed if something goes wrong. Numbat lets them reconstruct what the agent did after the fact, straight from artifacts already on disk.
None of numbat's rules block anything. Enforcement is off by default, per the repo, even though the rule set spans privilege escalation, secret exfiltration, and lateral movement checks.
Numbat watches through local hooks and OTLP/HTTP log exporters, normalizing everything into one event model that a CEL rule engine evaluates.
When a rule trips, it produces a case bundle with a SHA-256 manifest, evidence meant to hold up rather than a log line.
It's a single Go binary, no cgo, running on macOS, Linux, and Windows. Apache 2.0 licensed, it had 239 stars at v0.1.1.
Perplexity built the forensics half of an agent security product and shipped it while skipping enforcement entirely. That's a sign even the team behind the 52 rules doesn't trust automated blocking on a coding agent yet. Whether a future release adds a block mode is the thing to watch.
Each link below shares sources, entities, or timing with this story.
Claude Code criticizes Windows / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code criticizes Windows); both cover Apache, Claude Code, Codex, Linux; reported by the same outlet (github.com).
Linked by a graph relationship (Claude Code criticizes Windows); both cover Claude Code, Codex, Linux, OpenCode; reported by the same outlet (github.com).
Claude Code criticizes Windows / Shared entities / Same source domain / Shared topic
Linked by a graph relationship (Claude Code criticizes Windows); both cover Claude Code, Codex, July, OpenCode; reported by the same outlet (github.com).
Claude Code criticizes Windows / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code criticizes Windows); both cover Apache, Claude Code, Codex, OpenCode; reported by the same outlet (github.com).
Linked by a graph relationship (Claude Code criticizes Windows); both cover Claude Code, Codex, OpenCode; reported by the same outlet (github.com).
Linked by a graph relationship (Claude Code criticizes Windows); both cover Claude Code, Codex, July, Opencode; reported by the same outlet (github.com).
Linked by a graph relationship (Claude Code criticizes Windows); both cover Apache, Claude Code, Codex, July; reported by the same outlet (github.com).
Linked by a graph relationship (Claude Code criticizes Windows); both cover Claude Code, Codex, July, Linux; reported by the same outlet (github.com).