Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 3 of 21

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityThreat IntelligenceSupply ChainIncident ResponseAI Agent SecurityClaude CodeAgent SecurityPrompt InjectionCredential TheftMCPOpenAIAnthropicVulnerabilityClaimed vs VerifiedCodex

251 posts

Nov 4, 2026 · 10 min readWardenStealer and Aoki Infostealers Steal Claude Code and Codex Tokens: What SpyCloud FoundSpyCloud analysed recovered infection logs from two Windows infostealers, WardenStealer and Aoki, and found Claude Code and Codex credential files inside. Here is what they take, why a password reset does not help, and what to revoke.Nov 3, 2026 · 11 min read3AM Ransomware at a UK School Estate: Bitdefender Sees a Human-Plus-Agentic-Loop IntrusionBitdefender documented a 3AM ransomware intrusion at a UK school estate in which retries every 40 to 101 seconds, model-style command errors and numbered scripts suggest a language model in the loop. This post separates what is shown from what is not, and lists what to detect.Nov 3, 2026 · 10 min readClaude Cowork EDR Sensor in the Local VM: What It Sees and What It MissesHost EDR cannot see inside the virtual machine where Claude Cowork runs shell commands. Anthropic now lets admins install an approved vendor sensor in that VM. Here is how it works, where the data goes, and what stays uncovered.Nov 3, 2026 · 10 min readCrowdStrike Falcon Guardian AI Kill Switch: What It Stops and What It CannotOn November 3, 2026 CrowdStrike announced an AI Kill Switch for Falcon Guardian and a Falcon integration for Claude Cowork. The kill switch cuts an agent off from its models through AI gateways. Here is what that does and does not cover.Nov 3, 2026 · 11 min readGitBook Says AI Agents Attacked It: Rotate API Tokens, Git Sync Secrets and Re-Authenticate the MCP ServerGitBook says a sophisticated, highly targeted attack using AI agents reached some of its infrastructure credentials on November 2, 2026. It revoked every personal API token and asks customers to rotate third-party secrets and re-authenticate the GitBook MCP server. This post separates what GitBook has confirmed from what is still unknown, and gives a rotation and log-checking plan for people who connect coding agents to documentation platforms.Nov 3, 2026 · 10 min readCodex Training Setting Re-Enabled? What Is Claimed and What OpenAI DocumentsA Hacker News post says a team that had disabled data sharing found it switched back on. OpenAI has not confirmed a reset. We separate the claim from the documented controls and list what to check today.Nov 3, 2026 · 10 min readOpenAI: Agents Respect Warnings More in Production Than in Safety Tests, and Why Evals MisleadOpenAI compared safety-eval results with matched Codex production decisions and found a 10.2 to 37.4 point gap, driven by what models believe an eval is testing. Here is what it says and what to enforce yourself.Nov 3, 2026 · 12 min readRailway AI Agents and Primcloud: Claimed vs Verified, and What to Lock DownOn November 3, 2026 the founder of Primcloud accused a Railway engineer of trying to breach his infrastructure. Railway's CEO apologized and said the activity looked agent-driven. Most details come from one side. Here is what is claimed, what is verified, and what to check on your own agents.Nov 3, 2026 · 14 min readWorkOS Breach: ARTEX Linked to Sales App Access and Customer Slack Excerpts, Confirmed vs ClaimedWorkOS disclosed on November 2, 2026 that an internal sales application was accessed without authorization, exposing CRM data and excerpts of customer conversations. Its CEO tied the attack to the ARTEX framework; the bulletin does not. Here is what is confirmed, what is not, and what to do.Nov 2, 2026 · 10 min readCyberStrikeAI: How an LLM on the C2 Server Took Over Education Domains in 3-4 DaysKaspersky's Securelist team describes CyberStrikeAI attacks where a server-side language model chose the commands and a dumb implant ran them, reaching domain admin in 3-4 days. The techniques were old; the speed was not.Nov 2, 2026 · 9 min readFake ChatGPT and Claude Bots Are Scanning the Web for .env Files: What Cequence FoundOne actor rotated through about 32 AI bot identities, including ChatGPT, Claude and Perplexity, to request roughly 90 secret-bearing file paths. Cequence says a bot's claimed name proves nothing. Here is what that means for your servers and your logs.Nov 2, 2026 · 11 min readARTEX and Friends: What Google and Mandiant Saw Agentic Attack Frameworks DoGoogle Threat Intelligence Group and Mandiant say attackers have run open-source agentic pentest frameworks in real incident response cases since late August 2026. Here is what ARTEX did, how to spot it, and the five defense layers Mandiant recommends.

Page 3 of 21 · 251 posts