Teleport has made Teleport Beams generally available, a trusted runtime that gives AI agents delegated identity and approved execution plans instead of stored credentials when they touch production infrastructure. Beams has been in public beta since March 2026 and became generally available on 9 November 2026.
Teleport argues that traditional sandboxes, which isolate agent workloads at VM level and manage credentials, do not control what a group of agents does together. Beams works on four layers. Identity: each runtime inherits a delegated identity from a user or another agent and starts with zero standing privileges, proposing execution plans that a human or an LLM judge reviews before a separate runtime carries them out. Access: agents reach cloud accounts, Kubernetes clusters, PostgreSQL databases and MCP servers with no secrets in their environment, authenticating through IAM, Kerberos, X.509 and similar methods.
The other two layers cover behaviour and environment. Beams records messages sent to inference models, flags goal hijacking and emergent coordination between agents, and scores each session against the MITRE ATT&CK framework, using seven prebuilt classifiers such as secrets exposed inline, destructive actions and privilege escalation, plus customer-defined rules. Agents run in ephemeral micro-VMs with virtualised networking that controls egress, ingress and DNS, and a kill switch ends an agent's activity and its connections to production at once.
Beams sits on the Teleport Infrastructure Identity Platform, which Teleport says runs at more than 700 enterprises. Ev Kontsevoy, Teleport's chief executive and co-founder, said most enterprises have not connected agents to production because they lack delegated identity and strong access control without secrets. "Beams brings these missing capabilities to the market", he said.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
