Beacon

v1.0.1 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 13d Forensics & Incident Response

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

agent-ai-cli agent-security ci-cd claude-code cloud codex

+7 more

cursor detection-engineering endpoint-security mobile-device-management security security-information-and-event-management security-tools

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 12d

ReleasePort v1.0.1 adds managed GCS forwarding for macOS and hardens archive extraction against path traversal.

Why it matters: Security fact ID 63198 raises severity to 80, tightening path‑traversal protection in archive extraction; prioritize review if handling untrusted archives.

Summary

AI summary

Reject path traversal in archive extraction and add managed GCS forwarding for macOS.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Strengthens path traversal protection in archive extraction Strengthens path traversal protection in archive extraction Source: llm_adapter@2026-07-14 Confidence: high	—
Feature	Low	Adds managed GCS forwarding for macOS Adds managed GCS forwarding for macOS Source: llm_adapter@2026-07-14 Confidence: high	—
Bugfix	Medium	Rejects .. segments in archive entry names during extraction Rejects .. segments in archive entry names during extraction Source: llm_adapter@2026-07-14 Confidence: high	—

Full changelog

Changelog

Other

9800d090e9b2de36e2e9591accaed25bb65f97e7 Add managed GCS forwarding for macOS
31be1633d1f0b15c8b8be10f575a8ba58c1dd3dd Add managed GCS forwarding for macOS (#297)
43acf3c7da37868c6d41792809e7f7458da0317f Consolidate object storage setup guidance
c6436fccb80e425d0bbed527be321fa483b77a2d Document dual object storage installation
951554357c25a317c362b64b0db79be12d0cc13a Fix GCS guide formatting
cbae2c7ebf5f4200c4d081b1b2de37b3a773b850 Reject .. segments in archive entry names during extraction
b6b86d34a9a83df222fd19c47172eec4ac2db2ac Strengthen path traversal protection in archive extraction (#295)

Installation

Homebrew (macOS/Linux)

brew tap asymptote-labs/tap
brew install beacon

Manual Download

Download the appropriate archive for your platform from the assets below, extract it, and add the binary to your PATH.

Quick Start

beacon endpoint install
beacon endpoint status
beacon endpoint wazuh print-config

Threat detection rules

beacon ships with a small built-in baseline. Install the full threat-rule
pack (attached as threat-rules.tar.gz below) and scan your local telemetry:

beacon rules pull https://github.com/asymptote-labs/agent-beacon/releases/download/v1.0.1/threat-rules.tar.gz
beacon rules list
beacon scan

Security Fixes

Reject '..' segments in archive entry names during extraction — strengthens path traversal protection (#295)
Strengthened path traversal protection in archive extraction (#295)

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Beacon

Get notified when new releases ship.

About Beacon

All releases →

Related context

Related tools

Earlier breaking changes

v0.0.54 Require cloud run ID before upload