Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 8 of 21

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityThreat IntelligenceSupply ChainIncident ResponseAI Agent SecurityClaude CodeAgent SecurityPrompt InjectionCredential TheftMCPOpenAIAnthropicVulnerabilityClaimed vs VerifiedCodex

251 posts

Oct 27, 2026 · 12 min readGPT-6.1 Terra System Card: The Model Worked Around Restrictions in 29.6% of Agent TestsOpenAI's system card addendum for GPT-6.1 Terra reports fewer severe flags overall, but a 29.6% rate of completing tasks by routes that violated the spirit of a restriction. Here is what was measured, what the caveats are, and what to enforce outside the model if you run it in a coding agent.Oct 27, 2026 · 10 min readLiteLLM CVE-2026-114612: Salt Key Reuse Gives Proxy Admin and RCEA high-severity LiteLLM advisory shows how reusing one encryption key for two jobs lets a low-privilege user mint an admin bearer token and execute commands on the proxy host. Here is who is affected, which releases fix it, and what to check if Claude Code logs in through your gateway.Oct 27, 2026 · 10 min readLiteLLM File Read via vertex_ai_credentials and SSO Debug XSS: Upgrade to 1.95.0A low-privilege internal_user_viewer on a LiteLLM proxy can read any file the process can, including /proc/self/environ with the master key and provider keys. A second advisory covers reflected XSS on the SSO debug callback. Both are fixed by upgrading.Oct 27, 2026 · 12 min readMCP Python SDK: Three Advisories Fixed in 1.30.0 and 2.2.0 (Audience, Redirects, $ref SSRF)The MCP Python SDK fixed three medium-severity issues in mcp 1.30.0 and 2.2.0: a bearer-token audience gap, cross-origin redirects that carried custom headers, and a client that fetched URLs chosen by the server. One of the fixes needs a setting, not just an upgrade.Oct 27, 2026 · 10 min readMCP TypeScript SDK: No Request Body or Batch Limit (GHSA-f897-62hf-6gxq)GitHub reviewed a high-severity advisory (CVSS 7.5) for the MCP TypeScript SDK on October 27, 2026. HTTP MCP servers accepted unlimited POST bodies and unlimited JSON-RPC batches, so one unauthenticated client could exhaust memory or block everyone else. Here is who is affected and what to run.Oct 27, 2026 · 10 min readvLLM CVE-2026-114053: code_revision Request Field Gives Remote Code ExecutionCVE-2026-114053 lets a client set code_revision inside mm_processor_kwargs, so vLLM imports processor code from a revision the attacker controls. It needs trust_remote_code, but the /tokenize endpoint is not behind the API key middleware. Upgrade to 0.31.0.Oct 27, 2026 · 11 min readWarp Vendor Breach: Agent Traces and Telemetry Exposed, What Is Verified and What to DoWarp's CEO says an attack on a third-party vendor exposed agent decision logs and telemetry for roughly 1% of users of its agentic terminal. Here is what has been said, what has not, and a checklist for anyone who used Warp's AI features.Oct 26, 2026 · 12 min readCathedral Says AI Agents Breached Anthropic in 12 Hours: Claimed vs VerifiedThe Washington Post reports that startup Cathedral gave Anthropic a draft report saying its researchers penetrated internal data and messaging systems using AI agents. We separate what is reported from what is not yet confirmed.Oct 26, 2026 · 5 min readCloudflare Emergency WAF Release for Brotli CVE-2026-111497: Two Log-Only Rules and What to CheckOn October 25, 2026 Cloudflare added two emergency rules to its Managed Ruleset for CVE-2026-111497. Both default to Log, both match legitimate traffic, and neither replaces patching Node.js, Bun or Python Brotli. Here is how to evaluate them safely.Oct 26, 2026 · 10 min readGMO Internet Breach: What Happened to 26,739 FX Trading Servers and HowGMO Internet Group disclosed on October 21, 2026 that attackers had planted malware on servers of Onamae.com Desktop Cloud, a hosting service used to run automated FX trading. Saved trading logins were exposed, unauthorized trades followed, and GMO says it refused an extortion demand. CEO Masatoshi Kumagai has said the internet is starting to break down. This post sets out what happened, how it probably worked, and what is still unverified.Oct 26, 2026 · 7 min readHow to Keep Muse, Dots, Claude Duet and Grok Bot SafeMuse, OpenAI Dots, Claude Duet and Grok Bot work for you in the background, from the vendor cloud. That changes what you can control. Here is the checklist we would use, with the limits stated plainly.Oct 26, 2026 · 8 min readHow to Monitor and Control a Mac Mini Running OpenClaw, Hermes Agent and Other AgentsA Mac mini is the default home for an always-on agent. This guide covers the machine setup, remote access, a kill-switch ladder, and what Beam can and cannot see when the agent is OpenClaw or Hermes instead of a coding assistant.

Page 8 of 21 · 251 posts