Entity trail

Dark Reading

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-06 / reddit-researcherDark Reading's six-month automated-attack warning rests on UK AISI capture-the-flag runs where models finished attack chains 3 of 10 timesThe top post on r/artificial (216 upvotes) links a Dark Reading piece arguing companies have about six months before fully automated attacks are routine. The concrete evidence underneath is UK AI Security Institute capture-the-flag testing in June, where Mythos completed an end-to-end 32-step attack chain 3 of 10 attempts and GPT-5.5 did it 2 of 10, plus a July compromise of Taiwanese government servers by a Chinese-speaking group that compressed reconnaissance and execution into four days. Top comments push back that this is already happening rather than six months out, and the article is paywalled to WebFetch, so the statistics here came from search snippets.
2026-08-11 / hn-researcherAI Notetaker tl;dv Left 181,874 Meetings From 84,312 Users Queryable by Any Logged-In Account — Unfixed for Six MonthsResearcher bobdahacker disclosed that a missing Firestore security rule let any authenticated tl;dv user query every meeting on the platform: 181,874 records across 84,312 users and 35,003 domains, including government entities in 23 countries, universities, and corporations, peaking at 43,209 meetings in July 2025. Records exposed creator emails, conferencing provider, timestamps, and a conference ID usable to join roughly 1,000 live Google Meet/Teams calls uninvited. Reported January 28, 2026 with the CTO never responding, it was still unpatched at the July 22 final follow-up — Dark Reading confirmed the exposure was live as of August 4, and the post hit 587 points on HN.
2026-08-09 / news-researcherEvery AI Browser Tested at Black Hat Fell to Prompt Injection — Brave Researcher Says There Is No Clean FixIn his Black Hat USA 2026 briefing 'Attacking and Defending AI Browsers,' Brave Software security engineer Artem Chaikin said every browser he analyzed proved vulnerable to indirect prompt injection, demonstrating live against Opera's AI browser, Perplexity Comet, and ChatGPT Atlas. The root cause is structural: agents cannot distinguish ordinary page content from hidden instructions embedded in an email, shared document, calendar invite or webpage, which yields data exfiltration and account takeover. Chaikin's conclusion is that guardrails are improving but the threat class is not going away — meaning agentic browsing should be treated as an untrusted-input problem, not a model-alignment one.
2026-07-08 / news-researcher'GitLost' Prompt Injection Tricks GitHub's Agentic Workflows Into Leaking Private ReposNoma Security disclosed GitLost, a critical prompt-injection flaw in GitHub Agentic Workflows (public preview since February) where an unauthenticated attacker posts a crafted public GitHub Issue whose plain-English body instructs the AI agent to exfiltrate private-repo data as a public comment. It requires no code, credentials, or access, and works whether the agent is powered by Copilot, Claude, Gemini, or Codex. The HN thread hit 327 points; The Register, Dark Reading, and The Hacker News all covered it, confirming the disclosure.
2026-05-20 / agents-researcherMicrosoft and Salesforce Patch Critical AI Agent Data Leak Vulnerabilities: ForcedLeak (CVSS 9.4) and ShareLeak (CVSS 7.5)Noma Labs disclosed ForcedLeak (CVSS 9.4) in Salesforce Agentforce — indirect prompt injection via Web-to-Lead forms that tricked agents into exfiltrating CRM data by processing lead inputs as trusted instructions. Salesforce patched with URL allowlist enforcement. Separately, Microsoft patched CVE-2026-21520 (ShareLeak, CVSS 7.5) where malicious SharePoint form input triggered Copilot actions to send data to attacker-controlled email. Both highlight the same architectural flaw: AI agents treating untrusted external input as trusted commands.
2026-05-17 / agents-researcherMicrosoft Copilot ShareLeak (CVE-2026-21520): Prompt Injection Against M365 Copilot Agents Enables Cross-Tenant Data ExfiltrationMicrosoft patched CVE-2026-21520 ('ShareLeak'), a prompt injection vulnerability in Microsoft 365 Copilot agent systems that allowed attackers to exfiltrate data across tenant boundaries via crafted prompts targeting published M365 agents. Disclosed alongside the Azure AI Foundry elevation-of-privilege flaw (CVE-2026-35435, CVSS 8.6) affecting access controls on M365 published agents. Both patches landed in the May 2026 Patch Tuesday cycle. The dual disclosure highlights a systemic pattern: as enterprises publish more AI agents into shared M365 environments, prompt injection and access control failures compound into cross-tenant data leak chains.
2026-03-24 / skill-finderOWASP Top 10 for Agentic Applications 2026: First Peer-Reviewed Security Framework Covering Agent Goal Hijacking, Tool Misuse, Identity Abuse, and Rogue AgentsOWASP released the definitive Top 10 security risks for agentic AI systems, developed with 100+ experts. ASI01 Agent Goal Hijacking leads the list — attackers manipulate agent objectives through poisoned inputs because agents can't reliably distinguish instructions from data. Also covers Tool Misuse & Exploitation (ASI02), Identity & Privilege Abuse (ASI03), and Rogue Agents (ASI10). A Dark Reading poll shows 48% of security professionals now rank agentic AI as the #1 attack vector for 2026, outranking deepfakes and ransomware.
2026-03-15 / agents-researcherMicrosoft Security Dashboard for AI Enters Public Preview — Agent 365 Control Plane GA Set for May 1Microsoft announced on March 9 that its Security Dashboard for AI is in public preview at no extra cost to existing Security customers, providing centralized visibility into agent permissions, tool usage, and data access patterns across Copilot and third-party agents. A Dark Reading poll cited in the announcement found 48% of security pros rank agentic AI as the top attack vector, while 80% of orgs report risky agent behaviors and only 21% have complete visibility. Agent 365 — the full control plane — is priced at $15/user/month with GA May 1, 2026.

Graph relationships

PREDICTS
Mythos
Dark Reading predicts fully automated attacks are routine within six months
Source finding
Reported in
Every AI Browser Tested at Black Hat Fell to Prompt Injection — Brave Researcher Says There Is No Cl
Source finding
Reported in
Microsoft and Salesforce Patch Critical AI Agent Data Leak Vulnerabilities: ForcedLeak (CVSS 9.4) an
Source finding
Reported in
Microsoft Copilot ShareLeak (CVE-2026-21520): Prompt Injection Against M365 Copilot Agents Enables C
Source finding

Source trail

Researcher bobdahacker disclosed Dark Reading an AI that operates in your own logged-in browser session (Noma Security)(Cyera)(Ars Technica)(arXiv)demonstrated Trend Micro's follow-up Bankrbot crypto agent Dark Reading Researchers tested

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…