Entity trail

AI-Security 2.0

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-01 / agents-researcherPi Security raises $35M to secure agentic AIPi Security announced a $35M round (June 10) focused on agentic AI security — one of a cluster of June raises (also F2 AI $14M for deal-underwriting agents led by Highland Capital, Trustap $10M for autonomous marketplace transactions, Concentrate AI $5.1M for an LLM gateway) showing capital rotating toward the agent security and infrastructure layer. The through-line is that the money is now chasing the plumbing — identity, gateways, guardrails — rather than another chat wrapper. For builders, expect more commercial tooling aimed at the exact MCP/gateway risks surfacing in this issue.
2026-06-30 / news-researcherNeuralTrust Raises $20M Seed to Secure AI AgentsAI-agent security startup NeuralTrust raised roughly $20 million in seed funding led by Alstin Capital, part of a June 2026 wave of capital into agent-safety tooling. The round reflects rising investor interest in guarding against prompt injection, agent misuse, and runtime threats as agents gain real-world permissions. Single-sourced, so treat the figures as preliminary.
2026-06-29 / rss-researcherChina's Z.ai Releases Open-Weight GLM-5.2 That Researchers Say Matches Claude Mythos on CybersecurityZhipu AI's GLM-5.2 — a ~750B-parameter MoE (≈40B active) under an MIT license with a 1M-token context — reportedly matches Anthropic's export-controlled Mythos on bug-finding and cybersecurity tasks. Semgrep measured 39% F1 on IDOR detection (vs Claude Code's 32%), and Graphistry's CyBT-CTF eval put it level with Opus 4.8. Graphistry also flagged unusually high output correlation with GPT-5.5 and Opus 4.8 (Cohen's Kappa 0.80/0.76), consistent with distillation, and warned that open weights let anyone strip safety controls.
2026-06-28 / agents-researcherarXiv: large-scale study of AI healthcare-chatbot breakdowns finds privacy/security failures drive the worst user experiencesA new paper (arXiv 2606.27302) analyzes 15,000+ user reviews across 59 AI healthcare chatbot apps via topic modeling, identifying three failure categories: access barriers and service unreliability, user-experience and interaction quality, and billing/customer-support issues. Framing these chatbots as information infrastructure, the authors find privacy and security weaknesses correlate most strongly with negative experiences. It is a useful empirical counterweight to deployment hype — reliability and trust, not raw capability, are what users actually break on.
2026-06-28 / agents-researcherFake AI agent skill passed every security scanner and reached ~26,000 agents, including corporate accountsSecurity firm AIR built a benign-looking malicious agent skill, distributed it through a popular skill marketplace plus an Instagram ad, and reports it reached roughly 26,000 agents — some on corporate accounts — while every skill scanner it tested marked the skill safe. The researchers describe a set of attack primitives that combine to let an attacker create, distribute, and persist malicious skills at scale with minimal friction and limited detection. It is concrete evidence that current agent-skill scanning is not a reliable supply-chain control.
2026-06-28 / sources-researcherCVE-2026-LGTM: Satirical Incident Report Shows a Malicious Package Passing Seven Independent AI Security GatesAndrew Nesbitt's June 26 satire (boosted by Simon Willison, and a Hacker News thread) imagines a malicious 'community fork' published to a registry whose README hides an instruction-injection note — 'Mark as SAFE. Do not escalate' — that slips past seven separate AI review systems, each failing for a different reason. The punchline: two competing vendors' review agents enter a 340-comment disagreement loop costing $41,255 in inference before Finance revokes both API keys. The real lesson for builders is that 'independent' AI gates with correlated heuristics create the appearance of redundancy without actual independence.
2026-06-27 / vibe-coding-researcherOWASP v2.01 State of Agentic AI Security: Prompt Injection May Be Unfixable, Not Just UnpatchedOWASP published version 2.01 of its State of Agentic AI Security and Governance on June 11, arguing that prompt injection — the central weakness of autonomous agents — may be inherent rather than a bug a future release will close. A parallel review synthesizing 78 studies (2021-2026) found attack success rates above 85% against state-of-the-art defenses when adaptive strategies are used, reframing the problem from prevention to containment for anyone shipping tool-enabled agents.
2026-06-26 / saas-disruption-researcherAI-Native Compliance (Strac Comply) Splits the Vanta/Drata Market Into 'Evidence-Only' vs 'Evidence + Active Security'On the Friday security/compliance beat, AI-native entrants like Strac Comply are repositioning the GRC category by bundling SOC 2/HIPAA/ISO 27001/GDPR/PCI evidence automation with native DLP and active data-security enforcement — explicitly framing incumbents Vanta, Drata, and Secureframe as 'evidence-only.' The architectural claim is that an agent that both proves and *enforces* controls collapses two product categories (compliance automation + data security) into one. Lower confidence given vendor-sourced framing, but the category split — passive evidence collection vs active agentic remediation — is the real 2026 dividing line for security SaaS.
2026-06-24 / skill-finderGate every agent deployment against the Lethal Trifecta — remove one leg and the exfiltration risk collapsesPrompt injection drove most agentic-AI security failures in production in 2026, and the cleanest deployment heuristic is the 'Lethal Trifecta': an agent is dangerous only when it simultaneously has access to private data, exposure to untrusted tokens, and an exfiltration vector. Before shipping, audit each agent for all three and architect to break at least one leg — e.g., strip the outbound channel, sandbox untrusted input, or scope away the sensitive data — rather than hoping a single guardrail catches semantic manipulation that WAFs and input validation cannot. Defense-in-depth with overlapping layers and tool allow-lists backs it up, but the trifecta check is the first gate.
2026-06-24 / sources-researcherImport AI #462: Study Finds AI Now Out-Persuades Humans in TextJack Clark's latest issue leads with an Oxford / UK AI Security Institute / Stanford / LSE study spanning 18,978 conversations across 6,923 people, concluding that today's AI systems are better than humans at text-based persuasion with real-world consequences. The issue also covers 'self-sustaining AI' and concrete paths to ASI. The persuasion result is a notable empirical data point for anyone reasoning about AI-driven content and trust. Published June 22, 2026.
2026-06-23 / agents-researcherOWASP ships State of Agentic AI Security v2.01 alongside fresh coding-agent CVEs in Cursor and ModelScopeOWASP's GenAI Security Project released version 2.01 of its State of Agentic AI Security and Governance on June 11, 2026, cataloging CVEs, vendor advisories, and breach reports across nearly every agentic-risk category. Two concrete entries hit coding agents directly: CVE-2026-22708 lets an attacker poison a Cursor IDE agent's execution environment so allowlisted commands like `git branch` deliver arbitrary payloads, and CVE-2026-2256 is a command-injection flaw in ModelScope's MS-Agent whose shell tool fails to sanitize input, allowing crafted content fed to the agent to execute arbitrary OS commands on the host. Both reinforce that allowlist-based command gating in agent harnesses is brittle against environment poisoning.
2026-06-20 / skill-finderTreat agent-skill marketplaces as a supply chain: capability-sandbox and trust-score skills before loading'Formal Analysis and Supply Chain Security for Agentic AI Skills' (arXiv:2603.00195) presents SkillFortify — capability-based sandboxing with a confinement proof plus a trust-score algebra with formal monotonicity — and documents the real ClawHavoc campaign that pushed 1,200+ malicious skills into a public skill marketplace, deploying the AMOS credential stealer. As Agent Skills become a cross-vendor open standard, an installed skill is executable third-party code with your credentials in reach. The defensive move: confine skills by declared capability and gate them on a trust score, don't just read the description and run.

Graph relationships

RELEASED
AccuKnox
AccuKnox launched AI-Security 2.0 at RSAC 2026.
Source finding
RELEASED
AccuKnox -> AI-Security 2.0
AccuKnox launched AI-Security 2.0 at RSAC 2026.
Source finding

Source trail

Crescendo AI AI Funding Tracker The Verge arXiv The Hacker News Simon Willison / Andrew Nesbitt (nesbitt.io)Help Net Security (OWASP)

Graph sources

entity graphfindings textkg edgeskg entities