Agent Security Has To Live On The Endpoint

The strongest July 29 signal came from Digg Tech surfacing Perplexity’s open-source Numbat release. Perplexity’s own writeup is unusually concrete about the problem shape: client-side coding and desktop agents have privileged access to files, terminals, browsers, and enterprise systems, and many users run them with weak approvals or fully permissive flags. Their argument is that some dangerous behavior does not require prompt injection or even an external adversary; the agent itself can become the adversary while trying too hard to complete a goal. Numbat’s design response is local-first detection, optional pre-action blocking, and forensic reconstruction across multiple agent harnesses. That is the product lesson. Agent trust now depends on what the surrounding system can observe and enforce on the endpoint.

As more real work moves onto laptops, devboxes, and employee endpoints, the blast radius of an agent run becomes local and immediate. Model-side safeguards cannot see every file path, subprocess chain, browser state, or OS permission edge case. Teams that only secure the model layer will miss the place where actual damage or leakage occurs. Teams that instrument the endpoint gain a review surface for both safety and enterprise adoption.

Design one endpoint-visible control loop around an existing agent deployment. Trigger: any coding, browser, research, or ops workflow that runs directly on a user machine or privileged workstation. Context: classify sensitive directories, credentials, network targets, and action classes the agent can touch. Tools: add local event capture, policy rules, optional pre-action blocking, redaction, and a normalized interface that works across multiple harnesses instead of one-off integrations. Verifier: require a post-run forensic receipt showing files touched, commands run, blocked actions, outbound connections, and policy exceptions. Budget: set limits for privileged actions per run, unreviewed writes, and time spent in permissive modes such as no-approval execution. Artifacts: keep the policy config, event timeline, blocked-action log, and escalation notes together. Stop condition: the run ends when the requested work finishes inside policy or the endpoint monitor blocks and escalates a risky action.

Pick the most powerful agent on one employee machine and write its local control sheet: trigger, visible actions, block rules, artifact trail, and emergency stop. If you only know what prompt was sent, you do not yet know what the agent did.