By Joab Jackson
Publication Date: 2026-05-26 15:44:00
The fight to maintain security has moved to the engineer’s messy desktop.
Last week, AI search provider Perplexity open-sourced an internal tool, Bumblebee, for checking developer machines, either Linux or macOS, for vulnerable software.
Continuous integration pipelines have baked security checks into them, with Software Bills of Materials (SBOMs) ensuring that the correct version of a package makes it to runtime. So malicious attackers are gravitating to the underbelly of enterprise security, the developer’s laptop.
Most developer machines are no doubt teeming with unpatched and outdated software, byproducts of various experiments and projects. There’s probably an outdated version of Node.js on most machines, or perhaps a never-used Warp terminal. Or maybe they downloaded a malware-infested package at some point, and it is just sitting on the hard drive waiting to be activated.
And certainly, many Perplexity engineers have plentiful recipes for agents lying around, which could be augmented with evil commands without the engineer’s knowledge.
The dev’s local environment also likely has valuable credentials that can be used to further infiltrate a secured environment.
Bumblebee Goes from Folder to Folder Picking out Vulnerabilities
Bumblebee is a read-only scanner that is installed on developer computers to search for vulnerable software. It looks for packages, extensions, and AI tool configurations that have been used in other security breaches.
“Bumblebee…
