Perplexity Introduces Bumblebee: A Novel Tool for Detecting Infected Software

Overview

• Bumblebee is a free, open-source tool designed to scan developer computers for compromised software and malicious configurations without executing any code.
• This innovative scanner addresses a critical security gap by analyzing AI connector files that may expose user data.
• Previously, a hacker group compromised over 160 software packages, highlighting the urgent need for tools like Bumblebee.

Perplexity has introduced Bumblebee, a unique scanning tool that identifies infected software packages, harmful browser extensions, and malicious AI tool configurations without running any potentially harmful code. This approach allows it to assess risks without triggering the very threats it aims to detect.

The urgency for such a tool was underscored by a recent incident on May 11, when the hacker group TeamPCP infiltrated over 160 software packages used by millions of developers worldwide, including offerings from Mistral AI and UiPath. This malicious code executed automatically upon installation, demonstrating the vulnerabilities present in the current software ecosystem.

The Significance of Non-Executing Scanning

Many software packages, especially in the JavaScript realm, can run hidden scripts immediately during installation, which can lead to rapid infection spread. Traditional scanners that engage with package managers risk activating these scripts while searching for infections. In contrast, Bumblebee sidesteps this issue by analyzing raw metadata files, ensuring that no software is executed during the scanning process.

A standout feature of Bumblebee is its capability to scan MCP configuration files, which dictate how AI tools connect to external services. These connectors can expose sensitive information, and if compromised, could lead to significant security breaches. Current security tools often overlook this risk, making Bumblebee's functionality particularly valuable.

Beyond MCP files, Bumblebee examines browser extensions across multiple platforms, including Chrome and Firefox, and assesses plugins for VS Code. The entire scanning process is efficient and results in a comprehensive report without altering any machine data.

Internal Use and Community Availability

Perplexity has been utilizing Bumblebee internally to enhance security for its Comet browser and AI agent. When new threats are identified, they are cataloged, reviewed, and then scanned across developer machines to ensure safety.

Bumblebee originated as an internal tool.

Enhancing security for users starts with protecting the systems that develop our products.

The tool also includes a threat directory based on recent supply chain attacks, including the May 11 incident, which was linked to the hacker group UNC6780. Bumblebee is openly available on GitHub under the Apache 2.0 license, allowing users to run, modify, and improve it freely.