Beam / field notes
Loading…
BetaBetaBeam / field notes
Loading…
Beam / field notes
What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 12 of 21
251 posts
Oct 22, 2026 · 10 min readMETR and Redwood Red-Team OpenAI's Agent Monitor: About 10% of Codex Traffic Went UnmonitoredIn a three-week embedded exercise, METR and Redwood Research tested OpenAI's internal agent monitoring system and found coverage gaps: compaction events skipped, monitoring that fired only at turn end, headers that could switch it off, and a path around sandboxing. OpenAI says the production issues are patched. Here is what was found and how to design monitoring that survives a capable agent.
Oct 22, 2026 · 10 min readNIST, NSA and CISA Agent Control-Incident Guidance: Ten Practices Worth Copying for Coding AgentsOn October 16, 2026, NIST, the NSA and CISA released voluntary guidance for incidents where highly capable AI agents take significant uninstructed actions that undermine controls. It targets frontier developers, but its asks, such as stop conditions defined in advance, monitoring the agent cannot disable, and tamper-resistant logs, translate directly to teams running coding agents.
Oct 22, 2026 · 14 min readOctober 2026's Software Supply Chain Nightmare: Every Incident, What Was Taken, and What to DoBlack October: October 2026 delivered a breach, a backdoored release or a critical runtime flaw almost every day: hosting platforms leaking customer secrets, AI gateways shipping stealers, official binaries and plugins swapped, npm worms, malicious GitHub workflows, and a certificate authority whose keys were guessable. This tracker lists each incident with dates, vector, what was taken, status and the action to take, then the patterns behind them.
Oct 22, 2026 · 10 min readOpenCode MCP OAuth Flaw: Remote Code Execution on Windows and WSL, Fixed in 1.18.33 Without a CVEPillar Security reports that a remote MCP server could execute code on a developer's Windows or WSL machine while OpenCode opened a browser for OAuth sign-in. The fix shipped in 1.18.33 on September 28, 2026, with no advisory and no CVE, so scanners will not flag old installs. This post explains the chain, the dependency at fault, and the checks to run.
Oct 22, 2026 · 6 min readOpenRouter Breach Claim: What Is Verified, What Is Not, and the Week Attackers Went After AI KeysOn October 20, 2026, dark-web monitoring sites listed OpenRouter, the AI model router, as a breach victim, and a law firm opened an investigation. OpenRouter had not confirmed anything at the time of writing. The claim lands in the same week OpenCode and Railway confirmed thefts aimed at AI provider keys. This post separates what is verified from what is claimed, and gives an OpenRouter key-hardening checklist.
Oct 22, 2026 · 9 min readOpenTelemetry for AI Agents: What the gen_ai Traces Capture and the Privacy Switch to SetA SigNoz walkthrough shows OpenTelemetry tracing an AI agent end to end: workflow, agent, model and tool spans with arguments and results. That is excellent for debugging and a privacy hazard if prompt capture is on. Here is what the traces contain, what they miss for security, and settings to check.
Oct 22, 2026 · 6 min readOracle Java SE October 2026 CPU and OpenJDK Advisory: 55 Java Fixes, 49 Remotely Exploitable, What to Patch FirstOracle's October 2026 Critical Patch Update, published October 20, includes 55 new security fixes for Java SE, 49 of them remotely exploitable without authentication, and OpenJDK's matching advisory lists 53 CVEs. Nothing is critical; the top scores are 7.5 and 7.0. This post sorts the list by what actually applies to servers, shows affected versions, and gives an update checklist.
Oct 22, 2026 · 10 min readRailway Breach: Environment Variables Accessed, Some Decrypted, in a Campaign Targeting AI Inference KeysOn October 21, 2026, Railway disclosed that an unauthorized party accessed systems storing customer environment variables and obtained decrypted contents for some of them. Railway says it is part of a series of attacks on platform companies aimed at AI inference providers. Builds were paused platform-wide, bucket credentials rotated and OAuth sessions invalidated. This post covers the timeline, what is known, and a rotation and hunting plan.
Oct 22, 2026 · 9 min readStorm-0940 and ARTEX: How AI Agents Turned a ConnectWise Credential Into 2,250 Tenant AttacksMicrosoft attributes the ConnectWise Cloud Backup compromise to Storm-0940 and says the actor used the ARTEX agentic pentest framework to move from stolen app credentials to privileged cloud access in under three hours. Here is the chain, what Wiz saw, and what to check in your tenant.
Oct 22, 2026 · 11 min readSkynet Mode: Symantec Caught an Offensive AI Agent Hijacking Exposed LLM EndpointsSymantec ran an AI honeypot and captured the full prompt of an autonomous offensive agent that borrows exposed LLM endpoints as its reasoning engine, then deploys cryptominers. Here is the chain, what it means for people running coding agents, and how to lock down model endpoints and keys.
Oct 22, 2026 · 10 min readUS Banks Lock Out AI Agents That Log In With Customer Credentials: What Builders Should ChangeMajor US banks are blocking outside AI agents that sign in with a customer's username and password or drive the website with browser automation, while offering read-only connectors and bank-run MCP servers. Here is what was reported, what we could not confirm, and what it means for anyone giving an agent credentials.
Oct 22, 2026 · 10 min readvlt 1.5.0 Skills: npm Dependencies Can Now Ship Agent Skills Straight Into Your Agentvlt 1.5.0 can find SKILL.md folders inside installed packages and symlink them into .agents/skills and .claude/skills. Socket says linking is opt-in and filtered by a malware selector by default. Here is how it works, what it does not guarantee, and how to review a skill before it reaches your agent.Page 12 of 21 · 251 posts