If you run other people’s model-written code for a living, the sandbox is the product. The Injection reports that JFrog, on November 1, 2026, published three critical flaws in Beta9, “the open-source runtime behind Beam that runs LLM-generated code in sandboxes.” The bugs “let any tenant reach the host worker as root.” JFrog scores all three CVSS 9.9; CVE-2026-120307 is the identifier attached to that cluster in The Injection’s listing. Fixes shipped in worker 0.1.756 and gateway 0.1.776.
Quick Take
- Product: Beta9, the open-source sandbox runtime used behind Beam, for running LLM-generated code.
- Bug: Three sandbox escapes that let any tenant reach the host worker as root, scored 9.9 each.
- Fix: Upgrade the worker to 0.1.756 or later and the gateway to 0.1.776 or later. Rebuild workers, do not only bounce them.
- Assume: If a multi-tenant worker was exposed before the patch, treat that host as compromised and rotate secrets it could reach.
What happened
Beta9’s job is to take code a model just wrote and run it in a tenant-isolated sandbox. A breakout to the host as root ends that isolation completely: one tenant can read other tenants’ jobs, steal worker credentials, and persist on the machine. JFrog found three separate ways to do that and published them together on November 1.
i10x has not reproduced the three primitives; the operational fact is the impact JFrog assigned — any tenant, host root, 9.9 — and the existence of a fixed worker and gateway pair.
What you should do
- Upgrade worker and gateway to the fixed versions, then roll the fleet. A single unpatched worker is enough.
- Rotate any secret, registry token, or cloud role the workers could access before the upgrade.
- Review logs for unexpected host-level processes or cross-tenant file access in the window before you patched.
What it means
Multi-tenant “run this AI-generated code” platforms are now a top-tier target, for the same reason CI runners and build farms always were: they combine untrusted code with powerful host credentials. A 9.9 on three escapes is as serious as this category gets. If you operate Beam, or any other Beta9 deployment, the patch is not optional and a rebuild is cheaper than a forensic argument later.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on The Injection’s week-44 summary of JFrog’s November 1, 2026 Beta9 advisories. i10x did not test Beta9 or Beam.
