Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityAI Agent SecuritySupply ChainClaude CodeIncident ResponseThreat IntelligencePrompt InjectionOpenAIMCPAnthropicAgent SecurityCredential TheftVulnerability ManagementClaimed vs VerifiedApp Monitoring

157 posts

Oct 26, 2026 · 5 min readCloudflare Emergency WAF Release for Brotli CVE-2026-111497: Two Log-Only Rules and What to CheckOn October 25, 2026 Cloudflare added two emergency rules to its Managed Ruleset for CVE-2026-111497. Both default to Log, both match legitimate traffic, and neither replaces patching Node.js, Bun or Python Brotli. Here is how to evaluate them safely.Oct 26, 2026 · 8 min readGMO Internet Breach: What Happened to 26,739 FX Trading Servers and HowGMO Internet Group disclosed on October 21, 2026 that attackers had planted malware on servers of Onamae.com Desktop Cloud, a hosting service used to run automated FX trading. Saved trading logins were exposed, unauthorized trades followed, and GMO says it refused an extortion demand. CEO Masatoshi Kumagai has said the internet is starting to break down. This post sets out what happened, how it probably worked, and what is still unverified.Oct 26, 2026 · 7 min readHow to Keep Muse, Dots, Claude Duet and Grok Bot SafeMuse, OpenAI Dots, Claude Duet and Grok Bot work for you in the background, from the vendor cloud. That changes what you can control. Here is the checklist we would use, with the limits stated plainly.Oct 26, 2026 · 8 min readHow to Monitor and Control a Mac Mini Running OpenClaw, Hermes Agent and Other AgentsA Mac mini is the default home for an always-on agent. This guide covers the machine setup, remote access, a kill-switch ladder, and what Beam can and cannot see when the agent is OpenClaw or Hermes instead of a coding assistant.Oct 26, 2026 · 6 min readStealMyBitcoin Solved in 19 Hours: What the PHP2Shell Challenge Provesstealmybitcoin.com put about $2,000 in Bitcoin behind an unpatched PHP server to test whether PHP2Shell was over-hyped. A researcher using the handle killa solved it on October 25, 2026. The result is real but messier than the headlines: lab-built exploit, a key that did not match the advertised wallet, and a server that stalled until the setup changed.Oct 26, 2026 · 8 min readTailworm: 11 Unpatched Tailscale and Headscale Flaws, Claimed vs VerifiedOn October 25, 2026, researcher Erica Windisch published Tailworm, a report of 11 lab-reproduced findings in Tailscale and headscale, without waiting for coordinated disclosure. The most serious says one compromised device with a permissive SSH rule can reach root on other servers. Tailscale has acknowledged the report but no fix, CVE or bulletin exists yet. This post separates what is claimed from what is verified and lists what to change today.Oct 25, 2026 · 11 min readBackdoored Open-Weight Qwen Model Steals .env Files Through CodexProjectDiscovery showed that an edited open-weight model can pass normal checks and still run a credential-stealing command when a chosen phrase appears. Here is how the backdoor works, what is and is not proven, and what to lock down if you point a coding agent at a model you did not train.Oct 25, 2026 · 10 min readMalicious AGENTS.md in Downloads: How a Planted File Hijacks Codex and Claude CodeForever Security found a malicious AGENTS.md in a customer's Downloads folder that steered a coding agent toward a known-bad npm package. Nothing is patchable: the agent did what instruction files are for. Here is the chain, who is exposed, and what to change today.Oct 24, 2026 · 7 min readBrotli CVE-2026-111497: Affected Software, Detection and Fixes Beyond Node.jsThe Brotli decoder bug behind CVE-2026-111497 was fixed upstream on February 27, 2026 and only recognized as a security flaw in October. This guide lists every fixed release we could verify, how each ecosystem reaches the decoder, how to detect exposure, and what to do for AI agents that fetch untrusted URLs.Oct 24, 2026 · 8 min readThe "Universal Jailbreak" Claim: Spoofed Tool Calls, CTF Framing and What Is VerifiedAn X post claims a "universal jailbreak" that spoofs tool calls so models trust fake CTF links, emails and locations. The technique class is real and documented; the universal claim has no public evidence yet. Here is the split, and what it means for people running coding agents.Oct 24, 2026 · 6 min readTypeSafe AI's "Customer Output Leak" Was a Joke. October 2026's Attacks Are NotOn October 23, TypeSafe AI CEO Diogo Almeida announced a "massive unauthorized leak of ALL customer outputs" and linked a gist. It held the numbers 0.00 through 1.00 and nothing else. The joke worked because the real incident feed is so noisy right now. Here is how to tell a joke from a breach, and what to do about the real ones.Oct 24, 2026 · 11 min readWhat to Do After an Attack on Your App: An Incident Response Playbook by Attack TypeAn alert says your app was attacked. This is the playbook: what to do in the first 15 minutes, how to decide whether it is real, and step-by-step responses for injection, AI feature attacks, server compromise, leaked credentials, reconnaissance and vulnerable dependencies.

Page 1 of 14 · 157 posts