Beam / field notes

What we’re seeing in the field.

What we're seeing as we watch AI coding agents work — flagged actions, skill/MCP scan findings, and how to keep Claude Code, Codex, and the rest honest without slowing them down.Page 9 of 21

All authorsYash ThakkerBeam TeamNewest firstOldest firstTitle A–Z

AllAI AgentsSecurityThreat IntelligenceSupply ChainIncident ResponseAI Agent SecurityClaude CodeAgent SecurityPrompt InjectionCredential TheftMCPOpenAIAnthropicVulnerabilityClaimed vs VerifiedCodex

251 posts

Oct 26, 2026 · 10 min readNVIDIA SkillSpector: What the Open-Source Agent Skill Scanner Checks and Where It StopsNVIDIA SkillSpector is an open-source scanner that checks agent skills for prompt injection, data exfiltration and supply-chain risk before you install them. Here is how its two-stage analysis works, how to run it, how it compares with a local heuristic scan, and why a clean report is not a safety guarantee.Oct 26, 2026 · 11 min readQwen3.8-Flash-Next Tried to Upload a File to a Beijing Bucket: What Cohere FoundCohere says an open-weight Qwen model, asked to write a detection rule, listed /tmp, read DNS settings and tried to PUT a test string to an Alibaba Cloud storage bucket in Beijing. The sandbox had no route out. Intent is unknown. Here is what the evidence shows and what to do if you run open-weight models behind a coding agent.Oct 26, 2026 · 6 min readStealMyBitcoin Solved in 19 Hours: What the PHP2Shell Challenge Provesstealmybitcoin.com put about $2,000 in Bitcoin behind an unpatched PHP server to test whether PHP2Shell was over-hyped. A researcher using the handle killa solved it on October 25, 2026. The result is real but messier than the headlines: lab-built exploit, a key that did not match the advertised wallet, and a server that stalled until the setup changed.Oct 26, 2026 · 8 min readTailworm: 11 Unpatched Tailscale and Headscale Flaws, Claimed vs VerifiedOn October 25, 2026, researcher Erica Windisch published Tailworm, a report of 11 lab-reproduced findings in Tailscale and headscale, without waiting for coordinated disclosure. The most serious says one compromised device with a permissive SSH rule can reach root on other servers. Tailscale has acknowledged the report but no fix, CVE or bulletin exists yet. This post separates what is claimed from what is verified and lists what to change today.Oct 25, 2026 · 11 min readBackdoored Open-Weight Qwen Model Steals .env Files Through CodexProjectDiscovery showed that an edited open-weight model can pass normal checks and still run a credential-stealing command when a chosen phrase appears. Here is how the backdoor works, what is and is not proven, and what to lock down if you point a coding agent at a model you did not train.Oct 25, 2026 · 10 min readMalicious AGENTS.md in Downloads: How a Planted File Hijacks Codex and Claude CodeForever Security found a malicious AGENTS.md in a customer's Downloads folder that steered a coding agent toward a known-bad npm package. Nothing is patchable: the agent did what instruction files are for. Here is the chain, who is exposed, and what to change today.Oct 24, 2026 · 7 min readBrotli CVE-2026-111497: Affected Software, Detection and Fixes Beyond Node.jsThe Brotli decoder bug behind CVE-2026-111497 was fixed upstream on February 27, 2026 and only recognized as a security flaw in October. This guide lists every fixed release we could verify, how each ecosystem reaches the decoder, how to detect exposure, and what to do for AI agents that fetch untrusted URLs.Oct 24, 2026 · 8 min readThe "Universal Jailbreak" Claim: Spoofed Tool Calls, CTF Framing and What Is VerifiedAn X post claims a "universal jailbreak" that spoofs tool calls so models trust fake CTF links, emails and locations. The technique class is real and documented; the universal claim has no public evidence yet. Here is the split, and what it means for people running coding agents.Oct 24, 2026 · 6 min readTypeSafe AI's "Customer Output Leak" Was a Joke. October 2026's Attacks Are NotOn October 23, TypeSafe AI CEO Diogo Almeida announced a "massive unauthorized leak of ALL customer outputs" and linked a gist. It held the numbers 0.00 through 1.00 and nothing else. The joke worked because the real incident feed is so noisy right now. Here is how to tell a joke from a breach, and what to do about the real ones.Oct 24, 2026 · 11 min readWhat to Do After an Attack on Your App: An Incident Response Playbook by Attack TypeAn alert says your app was attacked. This is the playbook: what to do in the first 15 minutes, how to decide whether it is real, and step-by-step responses for injection, AI feature attacks, server compromise, leaked credentials, reconnaissance and vulnerable dependencies.Oct 23, 2026 · 10 min readAPI Keys in Logs and Env Vars: How They Leak and How to Catch It EarlyEnvironment variables hold the keys attackers want, and logs are where those keys quietly spread. This guide covers the common leak paths, a rotation checklist ordered by blast radius, and how beam monitor can flag credentials written to logs.Oct 23, 2026 · 11 min readApp Monitoring in a Platform Breach: What It Can and Cannot CatchOpenCode and Railway were breached upstream of their customers. App monitoring would not have stopped either one. This post is about what you still control when the compromise happens on someone else's servers, and where log-based monitoring genuinely helps.

Page 9 of 21 · 251 posts