Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 11 of 21

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityThreat IntelligenceSupply ChainIncident ResponseAI Agent SecurityClaude CodeAgent SecurityPrompt InjectionCredential TheftMCPOpenAIAnthropicVulnerabilityClaimed vs VerifiedCodex

251 posts

Oct 23, 2026 · 3 min readRand Mutual Assurance Breach Claim: 366 GB and 1.68M Claim Records, Claimed vs VerifiedOn October 23, 2026, a threat actor on an underground forum claimed to have stolen 366 GB from Rand Mutual Assurance, the South African workplace injury and occupational disease compensation insurer. The claim comes from one relayed post, and RMA has not confirmed an incident. This post separates the claim from the evidence and lists what claimants and employers can do now.Oct 23, 2026 · 11 min readvLLM Multimodal DoS (CVE-2026-114055, CVE-2026-114050): Update to 0.31.0vLLM before 0.31.0 can be knocked over by a single multimodal request: oversized processor kwargs exhaust memory, and a forged item UUID kills the whole engine. Here is who is exposed, what the fix changes and how to harden a serving endpoint that agents call.Oct 23, 2026 · 6 min readWhat Is Tailscale? A Guide to Locking Down a VPS with Tailscale and Cloudflare TunnelAfter the PHP2Shell patches, developer Pieter Levels urged people to take VPS servers off the public internet using Tailscale for management and Cloudflare Tunnel for web traffic. This guide explains what Tailscale is, walks through the setup, and states what the pattern does not protect against.Oct 23, 2026 · 5 min readx402 SDK Critical Flaws: How a Malicious API Could Drain an AI Agent WalletOn October 22, 2026, security firm V12 published findings on the x402 payment SDK that agents use to pay for APIs. Three flaws were rated critical: the default client had no spending limit, a Solana facilitator accepted token approvals as payments, and the login flow signed messages meant for other sites. All three were fixed on August 18, but no advisory was published, so dependency scanners stay silent. This post explains each bug and how to check your agents.Oct 22, 2026 · 8 min readAI-Led Attacks in October 2026: Ransomware Run Through Coding Agents, Stolen AI Keys and AI-Found BugsOctober 2026 was the month AI showed up in every part of an attack. Ransomware affiliates ran intrusions through OpenCode with commercial models, lone actors used agents to breach banks and websites, attackers raided platforms for AI keys, and AI-found bugs were attacked before patches shipped. This post sorts what is verified from what is claimed, finds the patterns, and lists the defenses that work.Oct 22, 2026 · 12 min readClaude Code Puts Your Account Email in Request Headers: How the Leak Happens and a Hook That Blocks ItSince June 2026, GitHub issues have documented Claude Code injecting the signed-in account email into the model context and, in at least three reports, the model writing that address into a User-Agent header sent to third-party sites. This post traces the mechanism, separates what is verified from what is claimed, explains how an attacker can turn the same behavior into a lure, and gives a tested fail-closed hook, git hygiene, log cleanup and a site-owner policy.Oct 22, 2026 · 12 min readClaude Code Auto Mode Red-Team: Blocking Monitors Missed Over 55% of AttacksAnthropic researchers pointed a malicious Opus 5 agent at Claude Code's Auto Mode and an approximation of Codex's Guardian. Averaged across settings, the production monitors failed to block over 55% of attacks. This post explains the four attack types, which holes are already fixed, and which controls should sit outside the classifier.Oct 22, 2026 · 7 min readClaude Security Goes Continuous: How AI Code Scanning Fits a Security Program, and What It Does Not CoverAnthropic's October 21, 2026 update turns Claude Security into a continuous scanner with fix tracking, per-project threat models, a knowledge base, an API, webhooks, an MCP connector and role-based access, running on models including Claude Mythos. This post is for security teams deciding where it fits: what it adds over existing tools, what it cannot see, how to govern its access, and how to evaluate it during the free-credit window.Oct 22, 2026 · 10 min readCyberCartel's CARLIY0S: How Straiker Says Claude, Grok and Kimi Agents Targeted 400+ Latin American BanksStraiker's STAR Labs published a look inside CARLIY0S, an AI-orchestrated attack system it links to CyberCartel. Claude running in the Cursor IDE acted as commander, four Claude roles debated each target, five Grok miners harvested credentials, and the system fell back to hardcoded code when models refused. This post separates what Straiker saw from what it could not verify.Oct 22, 2026 · 6 min readGitLab CVE-2026-110264: CVSS 10.0 Unauthenticated RCE in the Regex Compiler, 12 Years of Releases, Patch NowOn October 21, 2026, GitLab shipped a critical patch for CVE-2026-110264, a CVSS 10.0 flaw where an integer overflow while compiling a crafted regular expression can let an unauthenticated attacker run code on self-managed GitLab servers. It affects every release since 7.0 in 2014. This post covers the fixed versions, the trap for anyone who patched on October 12, the 11 other fixes, and how to detect attempts.Oct 22, 2026 · 10 min readGoogle Agent Compute Engine: A MicroVM Per Agent and No Credentials in the SandboxGoogle describes Agent Compute Engine as a microVM-per-agent platform where the brain stays outside the sandbox and credentials are swapped in at an off-node gateway. Here is what Google actually published, what press coverage added, and which ideas you can apply to local coding agents today.Oct 22, 2026 · 10 min readMeta Muse Agent: Filesystem Export, Shared Artifact Links and VM Escape Reports, Claimed vs. VerifiedSeveral separate Muse stories are circulating: developers prompting the agent into zipping its root filesystem, shared artifact links reportedly found through passive DNS, and anonymous-source reports of rushed VM escape fixes. We sort which claims come from Meta, which from named researchers, and which from unnamed sources.

Page 11 of 21 · 251 posts