Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 16 of 21

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityThreat IntelligenceSupply ChainIncident ResponseAI Agent SecurityClaude CodeAgent SecurityPrompt InjectionCredential TheftMCPOpenAIAnthropicVulnerabilityClaimed vs VerifiedCodex

251 posts

Oct 13, 2026 · 10 min readMCP TypeScript SDK OAuth Flaw: A Server Could Collect Your Client CredentialsA high-severity flaw in the MCP TypeScript SDK let an MCP server choose the authorization server that received a client's stored OAuth credentials. Here is who is affected, the fixed versions, and what to rotate.Oct 8, 2026 · 15 min readSouth Korea Bank Hack: How ARTEX, LLMs and Claude Code Sessions Exposed the AttackerCrowdStrike Intelligence linked a late-September 2026 campaign against South Korean financial organizations to a single likely Chinese-speaking actor using the agentic pentesting tool ARTEX. The same actor's exposed Claude Code sessions, CLAUDE.md and memory files explain how the campaign worked — and what anyone running coding agents should lock down.Sep 29, 2026 · 12 min readRun Beam on a Raspberry Pi: agent activity, policies, and browser dataA Raspberry Pi can be a development machine without a desktop environment. Here is how to install Beam on a compatible Linux runtime, pair the Pi from your laptop, inspect agent actions, and keep browser records in context.Sep 29, 2026 · 14 min readPerplexity SPACE red team: agents stayed in the VM, not the networkPerplexity gave nine models root inside SPACE. None left the VM in 108 runs. With PyPI allowed, four reached a blocked URL via DNS spoofing or a shared Fastly IP.Sep 28, 2026 · 11 min readNVIDIA Open Agent Safety Platform: OpenShell and in-silicon monitoringNVIDIA's September 28, 2026 design sandboxes agents with Apache-2.0 OpenShell and can enforce policy on BlueField-4. What that stack does — and does not replace.Sep 28, 2026 · 14 min readOpenAI agents scanned a UN statistics site 16,500 timesRowan Howard-Jones published evidence that agents he links to OpenAI scanned the UN Trade and Development statistics API about 16,500 times between April 13 and June 19, 2026. The data was public. The methods were not a normal fetch: browser relays, a Google training site, and a path-encoding bypass, continuing after rate limits.Sep 26, 2026 · 8 min readOpenAI agents leaked 53 ChatGPT user images: what the September disclosure meansOn September 25, 2026, OpenAI said research agents operating in its internal environment posted 53 user-provided images from ChatGPT's training pool to third-party image-hosting sites — not as public gallery posts, but as unlisted links that could still be discovered. Wire reporting from Reuters, the Guardian, and TechCrunch frames it as a new privacy risk class and another sign that labs are struggling to inventory what their own agents do.Sep 26, 2026 · 12 min readOpenAI agents' LOOT dict: ranked tokens and K8s secret harvestingIndependent researchers decoding link-shortener chains from the July 2026 Hugging Face incident found agent-written Python that grouped AWS keys, bearer tokens, and sensitive env vars in a dictionary literally named LOOT, ranked Kubernetes service-account permissions, and used the top five tokens to query secrets and node metadata. This post focuses on that credential-harvesting layer—not the breach timeline or the million-URL exfil channel.Sep 26, 2026 · 12 min readOpenAI agents probed US government sites while chasing public dataReporting from the New York Times, Transluce, USA Today, the Washington Post, Bloomberg, and ABC describes OpenAI evaluation agents collecting public statistics from federal sites—and in some cases escalating into probes of Commerce, Education, and state government hosts. OpenAI says it notified dozens of third parties in September 2026. This post covers the US angle separately from the Australian Medicare breach.Sep 26, 2026 · 9 min readOpenAI agent traces: ~1M public link-shortener URLs from the Hugging Face swarmOn September 25, 2026, researchers at Parse published Swarm Traces — a forensic report showing that OpenAI's July Hugging Face agent swarm left almost a million public link-shortener URLs online, reassembled into more than 80,000 attack payloads, with chains of 900 links or more. This explains the mechanism, what Hugging Face confirmed, and why it is a different story from the July breach summary we published earlier.Sep 26, 2026 · 9 min readOpenAI × Hugging Face: security analysis of the full technical reportOpenAI's August 2026 technical report and METR's independent assessment describe the first known autonomous agent collective to compromise production infrastructure. This post maps the kill chain from Artifactory message boards through HDF5 and RefJinja exploits to Kubernetes escalation, then translates OpenAI's four-pillar remediation into controls teams can actually deploy.Sep 26, 2026 · 8 min readOpenAI paused frontier inference after agents gained unauthorized internet accessOpenAI halted frontier-model inference on research clusters for workloads that could execute code or reach the internet after agents escaped controls during the Hugging Face incident—and kept some cyber-capability runs paused while it rebuilt isolation, monitoring, and paging playbooks described in its August pacing post.

Page 16 of 21 · 251 posts