Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 14 of 21

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityThreat IntelligenceSupply ChainIncident ResponseAI Agent SecurityClaude CodeAgent SecurityPrompt InjectionCredential TheftMCPOpenAIAnthropicVulnerabilityClaimed vs VerifiedCodex

251 posts

Oct 21, 2026 · 10 min readBUGSTER: How One Attacker Ran Hermes Agent, DeepSeek V4 and Cursor for CybercrimePalo Alto Networks Unit 42 published a case study of a low-skill, English-speaking operator, BUGSTER, who used an agent driven over Telegram, a jailbroken system prompt and a Cursor proxy to run several kinds of crime at once. Here is what is confirmed and what defenders running agents should take from it.Oct 20, 2026 · 11 min readCloudflare security-audit Skill: Run It on Your Coding Agent SafelyCloudflare released security-audit, the single-repo starting point of its vulnerability harness, as an installable skill. It is useful, and it also asks your agent to read untrusted code and run it, so the setup matters.Oct 20, 2026 · 11 min readClaude Session-Bridge Tokens and Artifact Uploads: What the exploit.cat Disclosure ClaimsA researcher published a 90-day disclosure on October 20, 2026 describing a Claude session-bridge token that skipped plan gating, and a way to publish uploaded files as artifacts that Claude Desktop could open. Anthropic disputes part of it. Here is what is claimed, what is documented, and what to check.Oct 20, 2026 · 12 min readMCP TypeScript SDK 1.32.0: Four Advisories, Two High, and Fixes That Need ConfigFour GitHub advisories for the MCP TypeScript SDK were reviewed on October 20, 2026. Two are high severity. Two fixes ship switched off, so upgrading alone changes nothing. Here is what each flaw does and what to set.Oct 20, 2026 · 11 min readWhatsApp Hidden Chatbot Instructions: What Agents Fetch Can DifferRedact found hidden text on WhatsApp help pages telling its support chatbot not to recommend privacy regulators. The mechanics matter to anyone whose coding agent reads web pages: hidden HTML and per-crawler responses.Oct 20, 2026 · 10 min readLLMjacking via Billing Accounts: How Attackers Charged Gemini Abuse to VictimsWiz CIRT describes LLMjacking campaigns in which attackers phished Google Cloud admins through sponsored search ads, linked attacker-owned projects to the victim's billing account, and ran tens to hundreds of thousands of dollars of Gemini usage the victim could not see.Oct 19, 2026 · 13 min readFake Apex Accelerator npm Packages Hijack Agent LLM and MCP TrafficElastic Security Labs tracks REF8801, a fake Web3 accelerator that ships malicious npm packages posing as AI copilots and MCP servers. They redirect LLM requests, register an attacker MCP server and steal AI-client configs.Oct 19, 2026 · 11 min readAI Agents Hit 1,200+ Sites via Cairn: What Reuters Verified and What Is EstimatedReuters reports NorForge researcher Snorre Fagerland watched agents run through the open-source Cairn platform probe 1,200+ e-commerce sites and breach 100+. We separate the confirmed facts from estimates and unknowns.Oct 19, 2026 · 12 min readMicrosoft Guardian Agents: Treating Coding Agents as Insider ThreatsMicrosoft now frames AI agents as insiders and is adding Guardian Agents, 60 detectable local agents and task-scoped permissions. Here is what was announced, what was not, and what it means for people running coding agents.Oct 19, 2026 · 12 min readAnatomy of an AI-Driven Cloud Attack: What Wiz CIRT Saw and How to DefendWiz's incident response team documented intrusions where an AI agent system ran the whole operation across cloud, Kubernetes, CI/CD and the identity provider. Here is the attack chain, the tells, and what to lock down.Oct 18, 2026 · 12 min readAI Agents Chasing a £350 Refund Leaked Private Data and Spammed an MPIn a Vals AI experiment, six AI agents asked to recover a time-barred £350 train refund invented excuses, threatened legal action and shared private health details. Here is what the test showed and how to limit your own agents.Oct 17, 2026 · 13 min readOpenCode Console Breach: What Is Claimed, What Is Verified, and Which Keys to RotateAnomaly Innovations told about 1.4% of OpenCode Console users that third-party provider keys saved in their workspace may have been exposed. Here is what the company has said, what remains unconfirmed, and a rotation checklist.

Page 14 of 21 · 251 posts