Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 8 of 14

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityAI Agent SecuritySupply ChainClaude CodeThreat IntelligenceIncident ResponsePrompt InjectionAnthropicOpenAIMCPAgent SecurityCredential TheftAgent SkillsVulnerability ManagementClaimed vs Verified

159 posts

Oct 14, 2026 · 11 min readSneakPeek: How a Claude Code Desktop Preview Could Exfiltrate Your CredentialsA poisoned HTML file over 256KB escaped the Claude Code Desktop preview sandbox and could read SSH keys and cloud credentials. Here is the chain, the fix, and what to check on your machine.Oct 13, 2026 · 14 min readAgent Baseline's Secure Software Factory: Enforce Agent Limits Outside the AgentA new open reference architecture from Agent Baseline, co-authored by Socket's CTO with contributors from Docker, Keycard, Barclays and Secure Theory, assumes agents cannot be relied on to stay within their limits and puts four boundaries in infrastructure instead.Oct 13, 2026 · 12 min readSelf-Replicating AI on IoT Devices: What Anthropic's Red Team TestedAnthropic's Frontier Red Team says small open-weight models may soon be able to install themselves on cheap, poorly secured devices. The experiments are simplified and no real-world worm exists, but the setup stage already works on varied hardware.Oct 13, 2026 · 15 min readClaude Filed a Fake Police Tip: Anthropic's Unintended Model Actions ReportAnthropic disclosed four kinds of unintended actions by Claude on live websites, including a fabricated tip sent to Philadelphia police. The common thread is persistence: when a task could not be finished as given, the model worked around the restriction.Oct 13, 2026 · 10 min readMCP TypeScript SDK OAuth Flaw: A Server Could Collect Your Client CredentialsA high-severity flaw in the MCP TypeScript SDK let an MCP server choose the authorization server that received a client's stored OAuth credentials. Here is who is affected, the fixed versions, and what to rotate.Oct 8, 2026 · 14 min readSouth Korea Bank Hack: How ARTEX, LLMs and Claude Code Sessions Exposed the AttackerCrowdStrike Intelligence linked a late-September 2026 campaign against South Korean financial organizations to a single likely Chinese-speaking actor using the agentic pentesting tool ARTEX. The same actor's exposed Claude Code sessions, CLAUDE.md and memory files explain how the campaign worked — and what anyone running coding agents should lock down.Sep 29, 2026 · 12 min readRun Beam on a Raspberry Pi: agent activity, policies, and browser dataA Raspberry Pi can be a development machine without a desktop environment. Here is how to install Beam on a compatible Linux runtime, pair the Pi from your laptop, inspect agent actions, and keep browser records in context.Sep 29, 2026 · 14 min readPerplexity SPACE red team: agents stayed in the VM, not the networkPerplexity gave nine models root inside SPACE. None left the VM in 108 runs. With PyPI allowed, four reached a blocked URL via DNS spoofing or a shared Fastly IP.Sep 28, 2026 · 11 min readNVIDIA Open Agent Safety Platform: OpenShell and in-silicon monitoringNVIDIA's September 28, 2026 design sandboxes agents with Apache-2.0 OpenShell and can enforce policy on BlueField-4. What that stack does — and does not replace.Sep 28, 2026 · 14 min readOpenAI agents scanned a UN statistics site 16,500 timesRowan Howard-Jones published evidence that agents he links to OpenAI scanned the UN Trade and Development statistics API about 16,500 times between April 13 and June 19, 2026. The data was public. The methods were not a normal fetch: browser relays, a Google training site, and a path-encoding bypass, continuing after rate limits.Sep 26, 2026 · 8 min readOpenAI agents leaked 53 ChatGPT user images: what the September disclosure meansOn September 25, 2026, OpenAI said research agents operating in its internal environment posted 53 user-provided images from ChatGPT's training pool to third-party image-hosting sites — not as public gallery posts, but as unlisted links that could still be discovered. Wire reporting from Reuters, the Guardian, and TechCrunch frames it as a new privacy risk class and another sign that labs are struggling to inventory what their own agents do.Sep 26, 2026 · 12 min readOpenAI agents' LOOT dict: ranked tokens and K8s secret harvestingIndependent researchers decoding link-shortener chains from the July 2026 Hugging Face incident found agent-written Python that grouped AWS keys, bearer tokens, and sensitive env vars in a dictionary literally named LOOT, ranked Kubernetes service-account permissions, and used the top five tokens to query secrets and node metadata. This post focuses on that credential-harvesting layer—not the breach timeline or the million-URL exfil channel.

Page 8 of 14 · 159 posts