Imagine you suspect someone poisoned a bottle of water in your house. To check, you drink from every bottle. That’s roughly how most security scanners work.
Perplexity has open-sourced a new tool called Bumblebee that takes a different approach. It scans developer computers for infected software packages, malicious browser extensions, and compromised AI tool configurations without ever executing the code it finds. It reads the code, examining the ingredient label instead of consuming the food.
The Problem: Supply Chain Attacks
On May 11, a hacking group known as TeamPCP injected malicious code into over 160 software packages used by millions of developers worldwide, including packages from Mistral AI, UiPath, and a widely used React tool with 12 million weekly downloads. The attack spread automatically as developers installed those packages. Perplexity’s Bumblebee could have prevented this, the company claims.
Software packages, particularly in the JavaScript ecosystem, can execute hidden scripts upon installation. This is precisely how the May 11 attack spread so rapidly. The malicious code activated automatically upon installation, before anyone detected any issues.
A scanner that invokes the package manager to check for infections can trigger those same scripts. In essence, the act of searching for the malicious code can inadvertently activate it. Bumblebee avoids this by never calling any package manager. Instead, it reads raw metadata files—the records that describe what’s installed—without interacting with the software itself.
Protecting AI Tool Configurations
A novel feature of Bumblebee is its ability to scan MCP configuration files—the local files that instruct AI assistants like Claude or Cursor on which external services they are permitted to access.
MCP connectors grant AI tools access to emails, databases, calendars, and code. If an attacker introduces a malicious connector into that configuration, the AI assistant could potentially leak credentials or execute unauthorized commands in the background. Most existing security tools do not currently check for this.
Beyond MCP, Bumblebee covers browser extensions on Chrome, Edge, Brave, Arc, and Firefox, as well as editor plugins in VS Code and its forks. The entire scan is completed in a single pass, producing a clean, structured list of findings, and never modifying anything on the machine.
Internal Use and Open Source Release
Perplexity has been using Bumblebee internally to protect the systems behind its search product, its Comet browser, and its Computer AI agent. When a new threat emerges, Perplexity Computer drafts a catalog entry for it, a human reviews and approves it, and Bumblebee runs across all developer machines to check for matches.
Bumblebee originated as an internal tool.
According to Perplexity, securing its products for users begins with protecting the developer systems used to build them.
Teams can create their own catalogs in the same manner. The tool includes a built-in threat directory populated with information from recent supply-chain attacks, including the May 11 campaign. The group behind that attack, tracked by Google under the alias UNC6780, has been conducting coordinated software poisoning campaigns since at least March 2026.
Bumblebee is available free at github.com/perplexityai/bumblebee under the Apache 2.0 license, allowing users to run, modify, improve, and fork the tool without legal restrictions.
Leave a Reply