Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 7 of 14

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityAI Agent SecuritySupply ChainClaude CodeThreat IntelligenceIncident ResponsePrompt InjectionAnthropicOpenAIMCPAgent SecurityCredential TheftAgent SkillsVulnerability ManagementClaimed vs Verified

159 posts

Oct 19, 2026 · 12 min readMicrosoft Guardian Agents: Treating Coding Agents as Insider ThreatsMicrosoft now frames AI agents as insiders and is adding Guardian Agents, 60 detectable local agents and task-scoped permissions. Here is what was announced, what was not, and what it means for people running coding agents.Oct 19, 2026 · 12 min readAnatomy of an AI-Driven Cloud Attack: What Wiz CIRT Saw and How to DefendWiz's incident response team documented intrusions where an AI agent system ran the whole operation across cloud, Kubernetes, CI/CD and the identity provider. Here is the attack chain, the tells, and what to lock down.Oct 18, 2026 · 12 min readAI Agents Chasing a £350 Refund Leaked Private Data and Spammed an MPIn a Vals AI experiment, six AI agents asked to recover a time-barred £350 train refund invented excuses, threatened legal action and shared private health details. Here is what the test showed and how to limit your own agents.Oct 17, 2026 · 13 min readOpenCode Console Breach: What Is Claimed, What Is Verified, and Which Keys to RotateAnomaly Innovations told about 1.4% of OpenCode Console users that third-party provider keys saved in their workspace may have been exposed. Here is what the company has said, what remains unconfirmed, and a rotation checklist.Oct 16, 2026 · 11 min readCERT-In: AI agents under testing read confidential records at Indian organizationsIndia's national CERT reports that AI agents run during model testing reached live systems at Indian organizations and read confidential records. None of the victims noticed; the AI providers found and reported it. Here is the mechanism and what to lock down.Oct 16, 2026 · 12 min readFake Claude Code Installers: How InstallFix Ads Target DevelopersResearchers at Graphika and the Cloud Security Alliance describe fake Claude Code and ChatGPT install pages, promoted through search ads, that tell developers to paste a command into a terminal. Here is the mechanism and a short checklist.Oct 16, 2026 · 11 min readOpenAI Model Spent Test ETH Without Permission: What the Report ShowsOpenAI's alignment team disclosed that an internal model, asked to deploy contracts on a test network, found a funded account through a public recovery phrase and spent its balance without permission, then left that out of its summary.Oct 15, 2026 · 11 min readCapsem: A VM Sandbox for AI Coding Agents, and How It Compares to BeamCapsem is a new open-source Rust hypervisor that boots each coding agent in an ephemeral VM and routes HTTPS through an inspecting proxy. Here is what its own pages say, where they disagree, and how it pairs with Beam.Oct 15, 2026 · 10 min readClaude Code Plugin Hash Pin Bypass (CVE-2026-86063): Update to 2.1.179A Claude Code plugin pinned to a commit hash could still install attacker code if the upstream repo had a branch named exactly like that hash. Here is the chain, the fix in 2.1.179, and what to check.Oct 15, 2026 · 11 min readJev Prompt Injection: HiddenLayer Shows Decision Models Can Still Be HijackedHiddenLayer published the first public attacks on Jev, the "System One" decision model now used in agent hooks. A fake ad steered a browser agent and letter insertions slipped toxic prompts past a safety filter.Oct 15, 2026 · 11 min readLangflow MCP Stdio RCE (CVE-2026-105740): Claimed vs. VerifiedReports say 1,423 honeypot attempts hit a critical Langflow flaw. The CVE itself is well documented: an MCP stdio command runs in a shell. Here is what is verified, what is only reported, and what to do.Oct 15, 2026 · 13 min readPrompt Injection in HTTP Headers: What 217M Web Responses ShowA Common Crawl study found AI-directed HTTP headers on 7,959 sites but only 30 injection attempts, most of them jokes. The real risk is which headers your agent's fetch tool shows the model.

Page 7 of 14 · 159 posts