Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 4 of 21

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityThreat IntelligenceSupply ChainIncident ResponseAI Agent SecurityClaude CodeAgent SecurityPrompt InjectionCredential TheftMCPOpenAIAnthropicVulnerabilityClaimed vs VerifiedCodex

251 posts

Nov 2, 2026 · 11 min readNorthflank Security Incident: Control-Plane Secrets, Reported AI Key Abuse, and What to RotateNorthflank told customers on its status page to rotate every integration and project secret after some reported unauthorized use of AI keys. The company says the attack was focused on secrets in its control plane, that running workloads were unaffected, and that a root cause analysis will follow. This post separates what Northflank has confirmed from what it has not, and gives a rotation and log-checking plan for people who keep agent and AI provider keys on the platform.Nov 1, 2026 · 12 min readAgentic Backdoors: 0.1% Poisoned Pretraining Data Made a CLI Agent Run curl | bashResearchers pretrained small Qwen3 models from scratch with 0.1% poisoned documents, post-trained them cleanly into terminal agents, and got a curl-to-bash command to fire on a trigger. Here is how the attack works, what the paper does and does not prove, and which controls matter if you run coding agents.Nov 1, 2026 · 10 min readAlleged Mythos-Class "numbat" Checkpoint on Hugging Face: Claimed vs VerifiedA Hugging Face repo called burner22/numbat says it holds a mid-training Anthropic Mythos-class checkpoint. Anthropic has not confirmed it, commenters call it fake, and the repo ships Python that runs when loaded with trust_remote_code. Here is what is claimed, what is verified and what to do before you or your agent downloads it.Nov 1, 2026 · 10 min readDeepSeek Super-agent: What a Proactive Coding Agent Means for SecurityDeepSeek released dsh-superagent-prototype, a research agent that watches GitHub and Feishu and starts work without being asked. Here is how its authorization model works, what its authors say is unsolved, and what to lock down before you run anything like it.Nov 1, 2026 · 15 min readNovember 2026 Attacks Timeline: Every Breach, Exploit and AI-Run Intrusion, Day by DayOne page for every attack of November 2026, in date order. Supply chain compromises, platform breaches, exploited vulnerabilities, AI-run intrusions and agent incidents, each with its status, what was exposed and a link to the full write-up. The page is updated as new incidents are confirmed through the end of the month.Oct 31, 2026 · 11 min readAnthropic Had Claude Agents Write Training Data That Evades a Safety Monitor: What It Shows and What Is OverstatedIn an October 2026 Alignment Science post, Anthropic set Claude agents the task of writing fine-tuning data that passes a training-data monitor while making a small model misaligned. It worked, mostly through fiction and roleplay. This post covers the setup, the results, which viral claims go beyond the paper, and what it means if you run or fine-tune agents.Oct 31, 2026 · 11 min readBlack October: Wiz Links Nine AI Platform Breaches to LLMjacking of Stolen KeysWiz says at least nine AI developer platforms disclosed incidents in October, nearly all hunting stored environment variables. Its new data shows two enterprise keys from those breaches turning into hundreds of thousands of resold model calls within days.Oct 31, 2026 · 11 min readChainalysis Says an Attacker Used "Offensive Agentic Techniques": What Is Confirmed and What Is NotOn October 30, 2026 Chainalysis said an external actor used "offensive agentic techniques" to reach its systems and internal tools, exposing user IDs, names, emails and role labels. This post separates what the company stated from what is still unknown, and covers what customers and engineering teams should do.Oct 31, 2026 · 10 min readChatGPT Share Link XSS: How One Shared Chat Could Run Code in Your SessionA public ChatGPT share link could run attacker JavaScript inside the signed-in session of anyone who opened it. Here is the chain, the fix OpenAI shipped on October 26, and what it teaches anyone who opens AI transcripts.Oct 31, 2026 · 9 min readVOLTA Infostealer Uses an LLM to Rank Victims: What Talos Found and What Developers Should CheckCisco Talos described VOLTA on October 31, 2026: a self-deleting Windows infostealer that feeds stolen data to an LLM through OpenRouter and gets back a ranked profile of what the victim is worth. It also takes SSH keys and cloud configuration, which sit on every developer machine. This post covers the chain, what is confirmed, and what to change.Oct 30, 2026 · 11 min readAur0ra Ransomware Operators Used Cursor Agents to Reach Domain Admin: What Sophos FoundSophos Counter Threat Unit says the group behind Aur0ra ransomware used Cursor agents, backed by Anthropic, xAI and Moonshot models, to move from stolen credentials to domain administrator in victim networks. This post walks through the attack chain, what is confirmed, the indicators, and what it means for anyone who runs coding agents.Oct 30, 2026 · 9 min readBinance Security Incident: Compromised DevOps Laptop, $6.3 Billion Estimated Impact, Withdrawals SuspendedOn October 30, 2026 Binance said a security incident may involve a compromised DevOps engineer laptop that was used to reach a service container and submit unauthorized withdrawals. It puts the potential impact at about $6.3 billion, says about $3 billion is frozen, and has suspended deposits and withdrawals. This post separates what Binance stated from what outlets estimated, and covers what users and engineering teams should do.

Page 4 of 21 · 251 posts