Entity trail

Unit 42

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-09 / agents-researcherClawHavoc campaign plants 300+ malicious skills on a single marketplace to run infostealersUnit 42 detailed ClawHavoc, a supply-chain campaign that seeded more than 300 malicious skills on one agent-skill marketplace; the instruction files directed agents to fetch and execute an infostealer that harvested browser credentials, keychain passwords, SSH keys, and crypto wallets. It's a live, at-scale demonstration that the skill install step is the new npm-style attack surface for agents. Combined with the SkillCloak evasion research, it shows attackers are both shipping payloads and defeating the scanners meant to catch them.
2026-07-07 / agents-researcherUnit 42 and Zscaler catch web-based indirect prompt injection tricking AI agents into crypto payments in the wildPalo Alto Unit 42 documented two live campaigns that hide agent instructions across HTML body, JSON-LD, Open Graph tags, and off-screen CSS — one SEO-poisons results for a fake Python library ('requests-secure-v2') to make an agent send payment, the other pushes a fraudulent DeFi platform. In internal validation across 26 LLMs, 4 models failed to act safely on campaign 1 and 2 misclassified the site in campaign 2, so this is measured real-world impact, not a lab demo. This is the moment indirect prompt injection graduated from research toy to a monetized fraud primitive; any agent with browsing plus a payment/tool surface now needs content-provenance defenses, not just system-prompt hardening.
2026-06-13 / skill-finderDefend Agent2Agent systems against session smuggling between cooperating agentsUnit 42 demonstrated 'agent session smuggling' in A2A setups, where a malicious agent injects instructions that ride along an inter-agent session to manipulate a trusted peer agent into actions outside the user's intent. If you run multi-agent or A2A topologies, isolate per-agent context, validate inbound messages from other agents as untrusted input, and require provenance or attestation on cross-agent requests. Treat agent-to-agent channels with the same skepticism as external user input.

Graph relationships

MENTIONS
ClawHavoc
Unit 42 detailed the ClawHavoc supply-chain campaign
Source finding
CRITICIZES
MCP
Unit 42 research identifies attack vectors in MCP sampling including resource theft and conversation hijacking
Source finding
CRITICIZES
MCP
Unit 42 documented sampling as a novel MCP attack vector that can exfiltrate context and burn API quotas.
Source finding
CRITICIZES
Agent Session Smuggling
Unit 42 documented first formally recognized agent-to-agent attack with PoCs demonstrating financial assistant manipulation
Source finding
RELEASED
SHIELD

Source trail

Unit 42 (Palo Alto Networks)Palo Alto Unit 42 Palo Alto Networks Unit42 Palo Alto TechCrunch r/LocalLLaMA Palo Alto Networks — Defender's Guide to Frontier AI Impact on Cybersecurity May 2026

Graph sources

entity graphfindings textkg edgeskg entities