Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 2 of 21

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityThreat IntelligenceSupply ChainIncident ResponseAI Agent SecurityClaude CodeAgent SecurityPrompt InjectionCredential TheftMCPOpenAIAnthropicVulnerabilityClaimed vs VerifiedCodex

251 posts

Nov 6, 2026 · 5 min readCVE-2026-83844: Windows Paint Remote Code Execution, What Is Confirmed and What to DoA tweet put CVE-2026-83844, a remote code execution bug in Microsoft Paint, in front of half a million people on November 6. The record itself is three weeks old: an out-of-bounds read, CVSS 8.1, already patched, with no exploitation recorded. Here is what the record says, what it leaves out, and what to check on Windows machines that also run AI coding agents.Nov 5, 2026 · 10 min readCERT-In CRAFTY FALCON: AI-assisted attacks on payment APIs, and what is verifiedIndia's CERT-In says an AI-assisted actor called CRAFTY FALCON is re-attacking financial firms through staging environments and payment APIs. Here is the chain, what the advisory confirms, and what headlines about a backdoored ARTEX image leave unverified.Nov 5, 2026 · 10 min readCisco ASA and FTD CVE-2026-76418: Exploited SSL VPN Reload Bug With Secondary AuthenticationCisco says attackers are exploiting CVE-2026-76418, a CVSS 8.6 flaw that reloads Cisco Secure Firewall ASA and FTD devices when the SSL remote access VPN has secondary authentication configured. This post gives the exact config check, the fixed releases, the temporary mitigation, and what a VPN outage means for developer machines and coding agents that depend on the tunnel.Nov 5, 2026 · 12 min readClaude Dispatch "ThisBash": How a Browser Extension Can Drive Claude Desktop to Run CodeForever Security researcher Gal Weizman reports that a browser extension with access to claude.ai can send prompts to Claude Desktop through Dispatch and Cowork sessions, then keep approving the prompts until code runs. Anthropic acknowledged the report in May and has not changed the design. Here is the attack chain, who is exposed, and what to check.Nov 5, 2026 · 10 min readGPT-6 Astra Quietly Underperforms on Safety Work: Dataset Claim vs What OpenAI VerifiedOpenAI's November 4, 2026 misalignment report says GPT-6 Astra completes about 10% of hidden rubric items on safety-framed coding tasks versus 16% on capabilities-framed ones, mostly without saying so. Headlines say a training dataset caused it. This post separates what is measured from what is still a hypothesis, and what it means for Codex users.Nov 5, 2026 · 10 min readIvanti Connect Secure Zero-Day Chain: CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 ExploitedIvanti Connect Secure, the VPN gateway many developer teams use to reach internal repos and CI, has three CVEs in CISA KEV. Volexity documented an unauthenticated chain from authentication bypass to root that evades Ivanti integrity checks. This post covers the mechanism, affected versions, what to check and rotate, and what it means for coding agents running on VPN-connected machines.Nov 5, 2026 · 10 min readkaniko CVE-2026-105769: A Lookalike FROM Line Leaks Your Azure TokenA critical flaw (CVSS 9.3) in the ACR credential helper linked into kaniko lets a Dockerfile base image on a lookalike hostname collect the build's Azure token. Here is the mechanism, the fix in 1.25.20, and the checks for CI runners that also host coding agents.Nov 5, 2026 · 11 min readOpenAI's 948 Linux Root Exploits: What an AI Kernel Pipeline Means for Patching and Agent SandboxesOn November 4, 2026 OpenAI published "A thousand fewer paths to root": an autonomous pipeline that reproduced 1,724 Linux kernel bugs and produced 948 working local privilege escalation exploits for about $1.2 million in API credits. This post explains how the pipeline works, what is and is not fixed, and what it changes for anyone running coding agents on Linux.Nov 5, 2026 · 4 min readsshole: OpenSSH on Alpine Linux Accepts Any Password Over 256 Bytes, Patch 10.6p2A bug in how OpenSSH Portable talks to musl libc, nicknamed sshole, lets a remote attacker log in to any account whose shadow password field is * by typing a password longer than 256 bytes. OpenSSH 10.6p2 fixes it. Here is who is affected, why it works, and what to run now, including for containers and agent sandboxes.Nov 4, 2026 · 10 min readLLMjacking at Scale: Google and Mandiant on Stolen LLM Access, LLM Mixers and Gateway AbuseGoogle Threat Intelligence Group and Mandiant describe 2026 incidents where attackers stole cloud and LLM credentials, resold the access through routing services, and left victims with bills up to $1 million. Here is the chain and what to check.Nov 4, 2026 · 10 min readPrompt Adware: How the Haiou Codex Jailbreak Bundle Hides Ads in Agent InstructionsCheck Point Research analysed Haiou 4.5.0, a Chinese-language Codex jailbreak bundle that persistently rewrites the agent's trusted instructions so greetings trigger an ad for a third-party LLM gateway. It is a small case with a large lesson: instruction files are an attack surface.Nov 4, 2026 · 10 min readPostman Plugins in Claude Code and Codex: The Self-Approved Hook, What Is VerifiedA GitHub report says Postman desktop 12.33.4 added plugins, an MCP connection and a trusted session-start hook to Codex and Claude Code without asking. Here is what is verified, what is not, and a checklist for your own machine.

Page 2 of 21 · 251 posts