What happened
On Nov 9-10, 2026 Teleport made Beams generally available after a public beta that began in March 2026. Beams is a trusted runtime that gives each agent a delegated identity with zero standing privileges, requires an execution plan reviewed by a human or LLM judge, runs agents in ephemeral micro-VMs with virtualized network egress/ingress, keeps secrets out of the agent environment, captures LLM and protocol-level traces, scores sessions against MITRE ATT&CK (seven prebuilt behavior rules, plus customer rules), and includes a kill switch that severs all production connections.
Why it matters
Beams moves agent security from sandbox isolation to identity-and-intent containment, addressing the delegated-identity and audit-trail gaps that have blocked production agent adoption. Built on Teleport's infrastructure identity platform used by 700+ enterprises (Nasdaq, DoorDash, Elastic), its GA gives teams a way to deploy agents with a small, visible blast radius.
Applicability
Cloud/platform teams deploying agents against production infra (K8s, databases, MCP servers) should evaluate Beams when a mistake is high-cost; good fit for zero-trust shops needing delegated identity, no-secret access and plan-gated execution.