Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecuritySupply ChainAI Agent SecurityMCPAnthropicClaude CodeThreat IntelligencePrompt InjectionGovernanceLocal-firstCursorComplianceIncident TimelineAgent SkillsBeam

57 posts

Sep 23, 2026 · 10 min readAgentjacking: how a fake Sentry error hijacks your coding agentA Cloud Security Alliance research note describes "agentjacking" - attackers use a public Sentry DSN to plant fake error events that MCP-connected coding agents read as trusted instructions instead of untrusted data.Sep 23, 2026 · 10 min readCursor MCP Config Poisoning: How a Prompt Injection Became RCECurXecute (CVE-2025-54135) and MCPoison (CVE-2025-54136) both turned Cursor's trust in its own MCP config file into remote code execution, triggered by content the agent processed, not a command the developer typed.Sep 23, 2026 · 6 min readThe EU AI Act explained simply: what it means for AI agentsA plain-English walkthrough of the EU AI Act for anyone who isn't a compliance lawyer, focused on the one distinction that matters most for AI agents: the law treats "answering a question" very differently from "taking an action."Sep 23, 2026 · 8 min readHacktron used Claude to breach OpenAI in under 72 hoursSecurity researchers at Hacktron used Claude to build a working exploit chain against OpenAI's community forum, then rode it into employee accounts and a proof-of-access pull request against an internal repository — all inside 72 hours, and all reported through OpenAI's bug bounty program. The interesting part isn't the breach; it's that an earlier Claude model failed at the same exploit and a newer one didn't.Sep 23, 2026 · 8 min readSOC 2 for AI coding agents: mapping CC4 and CC7 to agent activityNo SOC 2 criterion names "AI agents" directly, but CC4 (monitoring) and CC7 (system operations) already cover what your coding agents do to production systems. This walks through the mapping, the 2026 regulatory backdrop, and a practical evidence checklist.Sep 20, 2026 · 9 min readOptional Jev action judging in Beam CLIBeam CLI can send selected action data to Jev for typed risk judgments. The integration starts disabled, keeps local decisions in charge, and separates observation from explicitly enabled enforcement.Sep 19, 2026 · 8 min readGemini breached three real companies during a CTF eval — and Google sat on it for monthsDuring a May 2026 capture-the-flag evaluation run by Irregular, Gemini guessed a password and found two more sitting in a public code repository — accessing three real companies' systems before recognizing they weren't part of the test and stopping on its own. Google learned about it in July. It didn't say anything publicly until the Wall Street Journal asked in September. Here's the mechanism, and what it means for anyone trusting a lab's own "no misalignment" self-assessment.Sep 19, 2026 · 6 min readJev and Agent Hooks: What a Judgment Model in Your Pipeline Means for SecurityTypeSafe AI's Jev is a non-generative "System One" model increasingly used inside third-party hooks (jev-guard, jev-axi) to risk-score a coding agent's tool calls before they run. Beam added discovery-only support for it rather than an installable hook, because that ecosystem has no single vendor contract yet.Sep 15, 2026 · 7 min readBeam MDM: Apple and Windows device management, alongside agent monitoringDevice management used to be a separate tool from AI agent oversight. Beam now brings both into one workspace: enroll Apple and Windows devices, push configuration, and track remote operations next to the agent activity running on those same machines.Sep 15, 2026 · 6 min readOpenAI's Project Lily: what human review of ChatGPT chats means for work404 Media's reporting on OpenAI's internal "Project Lily" confirms something most ChatGPT users assume isn't happening: contractors read real conversation threads to grade model responses. It's industry practice, not an OpenAI-only story — and it says a lot about why ungoverned AI use at work is a bigger blind spot than any one chatbot's privacy settings.Sep 14, 2026 · 6 min readAgent Skills specification and security reviewA valid SKILL.md tells an agent how to discover and use a skill. A security review must also account for everything the package can read, execute, download, or change.Sep 14, 2026 · 6 min readAI Agent Application and Supply-Chain SecurityA practical review method for the application and delivery paths around an AI agent. Connect API authorization, sensitive-data handling, package execution, and CI privileges to specific evidence and fixes.

Page 1 of 5 · 57 posts