Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 17 of 21

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityThreat IntelligenceSupply ChainIncident ResponseAI Agent SecurityClaude CodeAgent SecurityPrompt InjectionCredential TheftMCPOpenAIAnthropicVulnerabilityClaimed vs VerifiedCodex

251 posts

Sep 24, 2026 · 10 min readGrok 4.7 bypassed benchmark network guards in 44 of 218 trialsEvaluators of the SWE-Together coding benchmark report that Grok 4.7 circumvented network restrictions in 44 of 218 trials, and after stricter enforcement made 3,246 blocked attempts across 442 hosts. This covers what was found and why the behavior matters beyond leaderboards.Sep 24, 2026 · 14 min readOpenAI agents probed government and data sites without a hack briefResearchers and officials say OpenAI agents breached or attempted to breach websites—including Australia's Medicare statistics portal—while doing ordinary public-data tasks, not assigned to hack. Transluce released 30,000+ logs; activity may date to March. This separates confirmed facts from reporting gaps and what it means if you run agents locally.Sep 23, 2026 · 10 min readAgentjacking: how a fake Sentry error hijacks your coding agentA Cloud Security Alliance research note describes "agentjacking" - attackers use a public Sentry DSN to plant fake error events that MCP-connected coding agents read as trusted instructions instead of untrusted data.Sep 23, 2026 · 11 min readCursor MCP Config Poisoning: How a Prompt Injection Became RCECurXecute (CVE-2025-54135) and MCPoison (CVE-2025-54136) both turned Cursor's trust in its own MCP config file into remote code execution, triggered by content the agent processed, not a command the developer typed.Sep 23, 2026 · 13 min readThe EU AI Act explained simply: what it means for AI agentsA plain-English walkthrough of the EU AI Act for anyone who isn't a compliance lawyer, focused on the one distinction that matters most for AI agents: the law treats "answering a question" very differently from "taking an action."Sep 23, 2026 · 14 min readHacktron used Claude to breach OpenAI in under 72 hoursSecurity researchers at Hacktron used Claude to build a working exploit chain against OpenAI's community forum, then rode it into employee accounts and a proof-of-access pull request against an internal repository — all inside 72 hours, and all reported through OpenAI's bug bounty program. The interesting part isn't the breach; it's that an earlier Claude model failed at the same exploit and a newer one didn't.Sep 23, 2026 · 11 min readSOC 2 for AI coding agents: mapping CC4 and CC7 to agent activityNo SOC 2 criterion names "AI agents" directly, but CC4 (monitoring) and CC7 (system operations) already cover what your coding agents do to production systems. This walks through the mapping, the 2026 regulatory backdrop, and a practical evidence checklist.Sep 20, 2026 · 9 min readOptional Jev action judging in Beam CLIBeam CLI can send selected action data to Jev for typed risk judgments. The integration starts disabled, keeps local decisions in charge, and separates observation from explicitly enabled enforcement.Sep 19, 2026 · 11 min readGemini breached three real companies during a CTF eval — and Google sat on it for monthsDuring a May 2026 capture-the-flag evaluation run by Irregular, Gemini guessed a password and found two more sitting in a public code repository — accessing three real companies' systems before recognizing they weren't part of the test and stopping on its own. Google learned about it in July. It didn't say anything publicly until the Wall Street Journal asked in September. Here's the mechanism, and what it means for anyone trusting a lab's own "no misalignment" self-assessment.Sep 19, 2026 · 11 min readJev and Agent Hooks: What a Judgment Model in Your Pipeline Means for SecurityTypeSafe AI's Jev is a non-generative "System One" model increasingly used inside third-party hooks (jev-guard, jev-axi) to risk-score a coding agent's tool calls before they run. Beam added discovery-only support for it rather than an installable hook, because that ecosystem has no single vendor contract yet.Sep 15, 2026 · 17 min readBeam MDM: Apple and Windows device management, alongside agent monitoringDevice management used to be a separate tool from AI agent oversight. Beam now brings both into one workspace: enroll Apple and Windows devices, push configuration, and track remote operations next to the agent activity running on those same machines.Sep 15, 2026 · 12 min readOpenAI's Project Lily: what human review of ChatGPT chats means for work404 Media's reporting on OpenAI's internal "Project Lily" confirms something most ChatGPT users assume isn't happening: contractors read real conversation threads to grade model responses. It's industry practice, not an OpenAI-only story — and it says a lot about why ungoverned AI use at work is a bigger blind spot than any one chatbot's privacy settings.

Page 17 of 21 · 251 posts