1. Executive summary
This is not a vulnerability or campaign advisory: it covers the release and hands-on evaluation of numbat, Perplexity AI's open-source observability tool for AI agents and MCP servers, published by the SANS Internet Storm Center on 5 September 2026. The context is an acknowledged industry gap — agent and MCP sprawl is proliferating with excessive privilege, opaque execution paths and no standard monitoring, a gap the ISC handler states was exposed by "the recent OpenAI/Hugging Face incident" (no technical detail on that incident is given in the source; treat the reference as context only). numbat provides agent enumeration, hook-based monitoring of Claude, Gemini and other desktop/CLI/IDE/gateway agents, a detection-rule catalog mapped to MITRE ATT&CK, selective enforcement, and IR case packaging. For EMEA financial services running AI coding and agent tooling on developer endpoints, the actionable takeaway is that agent activity on your estate is likely unobserved today, and this tool is a low-cost way to close that gap ahead of DORA/NIS2 scrutiny of AI supply-chain risk.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. This is a defensive tooling announcement, not an incident, vulnerability or third-party failure; nothing in the source describes an incident, a reportable event, or a specific ICT third-party arrangement. Clients deploying numbat fleet-wide via MDM may wish to consider it under their own ICT third-party risk processes, but no article in the regulatory reference is triggered by a distinctive fact in this item.
3. Technical analysis & attack chain
There is no attack chain to reconstruct — this item describes a defensive capability. The analysis below covers what numbat does, as verified in the ISC evaluation, because defenders need to understand the telemetry it generates and where it lands on disk.
The problem numbat addresses. The ISC handler characterises enterprise AI agent/MCP sprawl as: rapid decentralised proliferation of autonomous agents; protocol connections running with excessive privilege; opaque execution paths; and identity blind spots. The stated consequence is inability to prevent, detect or contain multi-hop autonomous exploits, enabling lateral movement, "shadow collaboration" and unauthorised data exfiltration. The handler's own enumeration (./numbat agents) surfaced more agents installed on their system than they expected — a concrete data point suggesting agent inventories are typically unknown even to security practitioners.
Tool architecture. numbat is a Go static binary for macOS, Linux and Windows, installable as a download or via Go (in which case the binary lands at /go/bin). It supports desktop, CLI, IDE and gateway agents through local hooks and plugins, OTLP/HTTP logs, and on-disk session artifacts.
Agent enumeration. ./numbat agents produces a full breakdown of installed agents: their available configs, available artifacts, whether a hook is available, whether that hook is wired, and the steps to wire it.
Hook installation and telemetry. Hooks are installed per agent, e.g.:
./numbat hook install --agent claude --emit all
./numbat hook install --agent gemini --emit all
Hooks start in monitor-only mode. With --emit all, events, findings, indicators and applicable enforcement decisions are written to ~/.numbat/records.ndjson by default. Records are NDJSON and render cleanly with jq . ~/.numbat/records.ndjson.
Detection rules. The built-in rule catalog is organised categorically: secrets, exfiltration, integrity, execution, reconnaissance, privilege, lateral movement, impact, source control, tampering, persistence, and sequences. numbat rules list shows the full catalog. The handler tested recon.network_sweep, defined as "a named scanner is given an explicit scan or target-list option and a network range," which maps to MITRE ATT&CK T1046 Network Service Discovery. It was triggered by prompting ClaudeCode to run an nmap scan; the finding and related artifacts were written to ~/.numbat/records.ndjson.
Enforcement. Rules can be promoted from detect to block. Per numbat's enforcement documentation: copy the shipped detection's complete YAML file from the matching release's shipped catalog into a controlled operator rules directory, keep the same id, set enforce: true, bump the rule version, validate the effective catalog, then deploy the same directory with the hook:
numbat rules check --rules-dir /opt/numbat/rules
numbat hook install --agent claude --managed --rules-dir /opt/numbat/rules --enforce
Investigation and IR packaging. numbat supports case creation, artifact bundling with a SHA256 manifest for integrity matching, and manifest verification:
numbat scan --case-id inv-03SEP2026 --emit all --output file --output-file investigations.ndjson
numbat case build inv-03SEP2026 --from investigations.ndjson -o inv-03SEP2026.numbat
numbat case verify inv-03SEP2026.numbat
This produces a folder named for the case ID containing events.ndjson, findings.ndjson, and the .numbat manifest file. The handler assessed the findings as complete, accurate and robust in evidence collection.
Timeline and collection. numbat timeline --agent claude is a read-only view grouping events by source_agent, source_type and session_id, each chronological step retaining its evidence reference. Deployment options include local use, live OTLP/HTTP capture (numbat collect), async HTTP delivery with no external shipper (numbat ship), and MDM-based fleet deployment including a guided MDM pilot.
Caveats. All technical detail above is single-sourced — one ISC handler's evaluation of a vendor tool. Adverse Trace has not independently tested numbat, and the source does not cover the full rule catalog, deployment options, or any limitations. The referenced "OpenAI/Hugging Face incident" is not described in the source; do not act on it without corroboration. No CVEs, threat actors or exploitation activity are associated with this item.
4. Mitigation & containment
This item is itself a mitigation. Prioritised adoption guidance for EMEA FS environments running AI agents:
P1 — within 24h
- Run
./numbat agentson developer and engineering endpoints to enumerate the actual AI agent and MCP server population. Treat the result as a shadow-IT inventory: any agent not in the CMDB is a finding. - Install monitor-only hooks on the highest-risk agents (those with filesystem, shell or network reach):
./numbat hook install --agent <agent> --emit all. Do not enable enforcement before baseline review.
P2 — within 72h
- Review
~/.numbat/records.ndjsonfindings against the rule categories (secrets, exfiltration, integrity, execution, reconnaissance, privilege, lateral movement, impact, source control, tampering, persistence, sequences). Prioritise any secrets, exfiltration or persistence findings for IR triage. - Stand up central collection:
numbat collect(live OTLP/HTTP) ornumbat ship(async HTTP, no external shipper) into your SIEM so agent telemetry is retained and alertable, not stranded on endpoints. - Review
numbat rules listoutput against your acceptable-use policy for AI agents and select candidate rules for enforcement.
P3 — within 7 days
- Promote selected rules to enforcement via the documented workflow: copy the rule YAML to a controlled operator rules directory, keep the id, set
enforce: true, bump the version, runnumbat rules check --rules-dir /opt/numbat/rules, then deploy withnumbat hook install --agent <agent> --managed --rules-dir /opt/numbat/rules --enforce. - Pilot MDM fleet deployment for managed rollout across the developer estate.
- Integrate the case workflow (
numbat case build/numbat case verify, SHA256 manifest) into your IR runbook so agent-misuse investigations produce court-grade artifact packages. - Add
numbat timelineoutput to standard IR timeline reconstruction for any incident involving an AI agent.
5. Indicators of compromise
No indicators of compromise available in the source material. This advisory describes a defensive tool; no malicious indicators are present.
6. Detection
Insufficient indicators to author detection rules. The source contains no threat artifacts — no malicious strings, hashes, command lines or registry keys — only defensive tooling commands. Authoring rules against numbat's own command lines would detect the defensive tool, not a threat. Clients should instead consume numbat's own detector catalog (numbat rules list) as their detection content for agent misuse.
7. Sources
- SANS Internet Storm Center — numbat - AI agent observability — https://isc.sans.edu/diary/rss/33312 — 2026-09-05 (Russ McRee, Handler on Duty)
8. Adverse Trace position
Severity: informational — no vulnerability, no active threat, no exploitation. No verified reference data resolved for this item and no CVEs, actors or IOCs are in play; nothing here warrants escalation on its own. The real risk to EMEA financial services is the gap the tool exposes: AI agents and MCP servers are proliferating on developer endpoints with excessive privilege and no observability, and the ISC handler — a security practitioner — was surprised by his own agent inventory. We assess that most FS clients cannot currently answer "what did our AI agents do last week," which is an unacceptable blind spot given agent-driven lateral movement and exfiltration are now trivially promptable. We recommend clients treat this as a low-cost, monitor-first pilot: enumerate, hook, baseline, then enforce. Adverse Trace will continue tracking agent-observability tooling and any reporting on the referenced OpenAI/Hugging Face incident; all detail in this advisory is single-sourced to the ISC evaluation and should be validated in your own environment before fleet-wide enforcement.
Published via PulseTrace — Adverse Trace threat intelligence.