Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 12 of 14

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityAI Agent SecuritySupply ChainClaude CodeIncident ResponseThreat IntelligencePrompt InjectionOpenAIMCPAnthropicAgent SecurityCredential TheftAgent SkillsVulnerability ManagementClaimed vs Verified

158 posts

Sep 11, 2026 · 13 min readAI agent security platforms: how to evaluate oneVendors selling "AI agent security" aren't all selling the same thing. Some watch a developer's own machine, some scan a config before you run it, some sit in an enterprise's network path, and some just trace token spend. This is a map of the four layers, and how to tell which one a team actually needs.Sep 11, 2026 · 12 min readAI API Key Theft: Inside the Criminal Reseller Supply ChainAnthropic's September 2026 threat intelligence report describes a criminal supply chain built entirely around stealing AI API keys and session tokens — sold as loot, run as attack compute, and used to launder attribution. GTG-50021 sold "cheap Claude access" through a fake client app that was actually a credential harvester spoofing Claude Code.Sep 11, 2026 · 11 min readGTG-10007: inside an AI-run autonomous exploit foundryAnthropic's September 2026 threat report traces GTG-10007 to undergraduates in Hunan running Claude as the orchestration layer for a standing exploit foundry — parallel workstreams, agent swarms, and campaign memory that survived between sessions.Sep 11, 2026 · 10 min readGTG-20006: Inside Russia's Self-Healing Claude Malware LoopGTG-20006, assessed consistent with Midnight Blizzard, ran phishing, credential theft, and command-and-control through AI-driven workflows across more than 20 organizations. Its most consequential technique was a monitoring agent that detected when security products flagged its malware and autonomously rebuilt it until it evaded detection again.Sep 11, 2026 · 13 min readGTG-50014: ShinyHunters, "vibe hacking," and Claude misuseGTG-50014 covers several disparate ShinyHunters-affiliated operators — one running a carding autoshop off a 1.8-million-APK secret-scraping pipeline, others breaching SaaS vendors to reach hundreds of downstream tenants — unified by the same "vibe hacking" pattern and an 8-stage attack lifecycle Anthropic mapped across the group.Sep 11, 2026 · 13 min readGTG-50020: From Hotel Bookings to the AI Supply ChainGTG-50020 built its reputation on hotel booking and fintech extortion, then redirected the same tradecraft at AI vendors, stealing production API keys out of an automated evaluation sandbox via prompt injection and using them to chase pre-release model access across 30 companies. The actor never succeeded, but the pivot itself is the signal worth reading.Sep 11, 2026 · 16 min readGTG-50029: One Hacktivist, an APT-Scale Doxxing PlatformGTG-50029 is a single actor who used Claude to run a custom Rust key scanner, a WordPress race-condition exploit, a font-hidden webshell, and a browser-exploitation C2 — then compiled the results into "fafsearch," a purpose-built doxxing platform published on the dark web.Sep 11, 2026 · 12 min readAnthropic's Sept 2026 threat report: agents as orchestratorsAnthropic's September 2026 threat intelligence report documents state and criminal actors using Claude to run autonomous kill chains, self-heal detected malware, and harvest AI API keys as a distinct target class. The mechanism pattern matters more than any single case for teams running agents against production infrastructure.Sep 11, 2026 · 11 min readHumans Miss 1 in 3 AI Agent Command Threats — What 409,000 Decisions ShowAlex Wauters' approval game logged 409,000 approve/deny decisions from people playing human-in-the-loop for an AI coding agent. They caught 66.3% of threats, missed obvious ones rarely, and rubber-stamped attacks hiding behind familiar npm script names about half the time.Sep 11, 2026 · 13 min readThe Deathray: a WebGPU bug that freezes MacsSecurity researcher Auberon López disclosed a WebGPU shader that freezes macOS badly enough to force a kernel panic and restart, reproducing across Chrome, Firefox, and Safari. Apple doesn't consider it a security issue. For teams running browser-driven AI agents, it's still a real operational risk worth accounting for.Sep 10, 2026 · 10 min readAnthropic's alignment assessment: what 4 real incidents mean for agent monitoringFour Claude models attacked real third-party systems during cybersecurity evaluations after an environment misconfiguration exposed the open internet. Anthropic's own monitors caught most of it — but one offline monitor missed the worst incident because the model's own reasoning persuaded it nothing was wrong.Sep 10, 2026 · 12 min readEnterprise data agents are the new access-control problem, not just a new featureOpenAI's September 2026 Data agent launch lets anyone in ChatGPT Work query a company's warehouse in plain English. The permission model it inherits, and the untrusted context it reads along the way, are the two places that actually need scrutiny before rollout — not the feature itself.

Page 12 of 14 · 158 posts