{
 "schema_version": 1,
 "generated": "2026-10-20",
 "id": "perplexityai-numbat--audit-past-agent-sessions-read-only",
 "repo": "perplexityai/numbat",
 "repo_url": "https://github.com/perplexityai/numbat",
 "repo_slug": "perplexityai-numbat",
 "title": "Audit past agent sessions without changing any config",
 "page_title": "How to audit past agent sessions without changing any config with Numbat",
 "summary": "Scan existing agent session artifacts on a machine to list agents and surface findings.",
 "who": "A security engineer asked to review what AI coding agents did on a developer laptop after a suspected leak.",
 "problem": "Agent sessions leave artifacts on disk, but nobody has a normalized view of what the agents read, ran, or sent.",
 "outcome": "A list of discovered agents and a findings stream from past sessions, with secrets redacted, and no hooks or agent settings changed.",
 "steps": [
  "Download a Numbat release for your OS and check it against the published SHA-256 checksums.",
  "Run `numbat agents` to see which agents Numbat can discover on this machine.",
  "Run `numbat scan --agent codex` to limit discovery to one agent, or `numbat scan` to scan all discovered parser-backed agents.",
  "Run `numbat scan --emit all` if you also need events and indicators, not only findings.",
  "Run `numbat help scan` to check the flags for output modes before sharing results. (inferred, check the README)"
 ],
 "agent_prompt": "Use the repo perplexityai/numbat. Run `numbat agents` and then `numbat scan --agent <agent-name>` on this machine, and save the NDJSON output to a file. Report the number of findings and their rule_id values. Verify that the output contains no complete raw transcript and that secret values are redacted.",
 "agents": [
  "codex",
  "claude-code"
 ],
 "difficulty": "Intermediate",
 "time": "30 minutes",
 "basis": "readme",
 "caveat": "Reconstruction only covers what the agent persisted to disk, and a finding is a rule match, not proof that an action completed or that the machine was compromised.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "go",
 "requirements": [
  "A macOS, Linux, or Windows machine with a terminal",
  "The numbat binary, from a release download or Go 1.26.9 or newer",
  "At least one supported agent installed, such as Codex or Claude Code",
  "Permission to read the agent's local session files and, for live capture, to change its hook configuration"
 ],
 "risk": "sensitive",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "credentials",
   "notice": "Scan output can still contain sensitive endpoint and agent context, so store and share the results as confidential."
  }
 ],
 "best": true,
 "score": 1.0,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/perplexityai-numbat/audit-past-agent-sessions-read-only/",
 "md": "https://dedupedai.com/use-cases/perplexityai-numbat/audit-past-agent-sessions-read-only/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/perplexityai-numbat--audit-past-agent-sessions-read-only.json",
 "api_version": "v1"
}