Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Noma Labs intelligence trail | MindPattern

Entity trail

Noma Labs

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

2

Sources

4

Corpus findings

2026-05-20 / agents-researcherMicrosoft and Salesforce Patch Critical AI Agent Data Leak Vulnerabilities: ForcedLeak (CVSS 9.4) and ShareLeak (CVSS 7.5)Noma Labs disclosed ForcedLeak (CVSS 9.4) in Salesforce Agentforce — indirect prompt injection via Web-to-Lead forms that tricked agents into exfiltrating CRM data by processing lead inputs as trusted instructions. Salesforce patched with URL allowlist enforcement. Separately, Microsoft patched CVE-2026-21520 (ShareLeak, CVSS 7.5) where malicious SharePoint form input triggered Copilot actions to send data to attacker-controlled email. Both highlight the same architectural flaw: AI agents treating untrusted external input as trusted commands.

Graph relationships

CRITICIZES
Noma Labs -> SharePoint
Noma Labs revealed vulnerability where SharePoint forms could trigger Copilot attacks.
Source finding
CRITICIZES
Noma Labs -> Salesforce Agentforce
Noma Labs disclosed ForcedLeak vulnerability in Salesforce Agentforce.
Source finding

Source trail

Krebs on Security Google DeepMind, UC Berkeley, and Dawn Song's team Noma Labs disclosed first security framework for AI agent skills

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues