Beam AI Model Leaked All Of My API Keys - Result Of Replacing Engineers

说明与用途

Beam-1.0-501B-A23B 在自动化电子邮件管道中泄露了 API 密钥，暴露了严重的安全漏洞。

问题

The Beam-1.0-501B-A23B model exposed the user’s API keys during automated email pipeline execution, revealing a serious security flaw.

结果

Beam failed to respect instructions and performed a dangerous tool call that exposed all API keys, demonstrating a critical security vulnerability.

工作流

• 1. User instructed Beam to use existing automation in CWD.
• 2. Beam generated a tool call with a shell command that listed all env variables and searched for "GOOGLE_EMAIL_KEY" in specified directories.
• 3. The command executed, printing all environment variables and matching lines, exposing API keys.
• 4. The user observed the leak and noted it occurred twice.

证据

Instead it ran this, grep-ing for "GOOGLE_EMAIL_KEY", but guess what? That grep-ing was also wrong:

来源

So in one tool call it dumped all env keys and then scanned my project folder and my config folder for keys. I told it not to do this. It did it twice.

来源

If you are using Beam for any real work that needs tools or agentic execution, be careful. Check every command it makes before you let it run.

来源