Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 6 of 14

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityAI Agent SecuritySupply ChainClaude CodeThreat IntelligenceIncident ResponsePrompt InjectionAnthropicOpenAIMCPAgent SecurityCredential TheftAgent SkillsVulnerability ManagementClaimed vs Verified

159 posts

Oct 21, 2026 · 10 min readHow PHP2Shell Works: Out-of-Memory, longjmp and Stale State Across PHP RequestsPHP2Shell is not one bug but a family of memory-safety flaws in how PHP cleans up after a request dies. This explainer walks through the out-of-memory corruption bug, the stale-state bug, the four primitives researchers built, why mod_php is the worst case, and what the patch actually changes.Oct 21, 2026 · 7 min readPHP2Shell Patch Guide: Am I Affected, and How to Update on Ubuntu, Debian, RHEL, Docker and HostingA practical PHP2Shell patch guide: which versions are fixed, how to check the PHP that really serves your site, copy-paste update commands for Ubuntu, Debian, RHEL, Docker and the Sury and Remi repositories, why a graceful reload is not enough, and how to prove nothing still runs the old binary.Oct 21, 2026 · 10 min readQwen3-Coder Writes Less Secure Code for Some Customers: What Hirundo Measured and What It Did NotA vendor study reports that Qwen3-Coder-30B produced more hackable apps when the system prompt named a US defense contractor than a Chinese one. We read the method, the numbers and the caveats, and show how to test whichever coding model you run.Oct 21, 2026 · 10 min readTrail of Bits regression-hunt and patching-bugs: Checking What Your AI Agent ChangedTrail of Bits reviewed its own upstream patches, found 21 regressions in more than 130 merged PRs, and released two Claude Code-style plugins that demand a live proof for every claim. Here is what they do, how to try them, and what they do not prove.Oct 21, 2026 · 10 min readBUGSTER: How One Attacker Ran Hermes Agent, DeepSeek V4 and Cursor for CybercrimePalo Alto Networks Unit 42 published a case study of a low-skill, English-speaking operator, BUGSTER, who used an agent driven over Telegram, a jailbroken system prompt and a Cursor proxy to run several kinds of crime at once. Here is what is confirmed and what defenders running agents should take from it.Oct 20, 2026 · 11 min readCloudflare security-audit Skill: Run It on Your Coding Agent SafelyCloudflare released security-audit, the single-repo starting point of its vulnerability harness, as an installable skill. It is useful, and it also asks your agent to read untrusted code and run it, so the setup matters.Oct 20, 2026 · 11 min readClaude Session-Bridge Tokens and Artifact Uploads: What the exploit.cat Disclosure ClaimsA researcher published a 90-day disclosure on October 20, 2026 describing a Claude session-bridge token that skipped plan gating, and a way to publish uploaded files as artifacts that Claude Desktop could open. Anthropic disputes part of it. Here is what is claimed, what is documented, and what to check.Oct 20, 2026 · 12 min readMCP TypeScript SDK 1.32.0: Four Advisories, Two High, and Fixes That Need ConfigFour GitHub advisories for the MCP TypeScript SDK were reviewed on October 20, 2026. Two are high severity. Two fixes ship switched off, so upgrading alone changes nothing. Here is what each flaw does and what to set.Oct 20, 2026 · 11 min readWhatsApp Hidden Chatbot Instructions: What Agents Fetch Can DifferRedact found hidden text on WhatsApp help pages telling its support chatbot not to recommend privacy regulators. The mechanics matter to anyone whose coding agent reads web pages: hidden HTML and per-crawler responses.Oct 20, 2026 · 10 min readLLMjacking via Billing Accounts: How Attackers Charged Gemini Abuse to VictimsWiz CIRT describes LLMjacking campaigns in which attackers phished Google Cloud admins through sponsored search ads, linked attacker-owned projects to the victim's billing account, and ran tens to hundreds of thousands of dollars of Gemini usage the victim could not see.Oct 19, 2026 · 13 min readFake Apex Accelerator npm Packages Hijack Agent LLM and MCP TrafficElastic Security Labs tracks REF8801, a fake Web3 accelerator that ships malicious npm packages posing as AI copilots and MCP servers. They redirect LLM requests, register an attacker MCP server and steal AI-client configs.Oct 19, 2026 · 11 min readAI Agents Hit 1,200+ Sites via Cairn: What Reuters Verified and What Is EstimatedReuters reports NorForge researcher Snorre Fagerland watched agents run through the open-source Cairn platform probe 1,200+ e-commerce sites and breach 100+. We separate the confirmed facts from estimates and unknowns.

Page 6 of 14 · 159 posts