Entity trail

Prompt Security

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-21 / news-researcherFortinet Buys Virtue AI to Add Runtime Protection for Agents and MCP ToolsFortinet announced on August 17 it has acquired Virtue AI, whose Guardian Agent red-teams autonomous agents across more than 50 sandboxed environments and 14 domains and enforces real-time guardrails over prompts, models, agents, MCP tool calls and AI infrastructure. Terms were undisclosed and Fortinet called the amount immaterial. The press release cites Gartner projecting the AI-and-agent security market growing from $2.8 billion in 2026 to $16.4 billion by 2030.
2026-08-20 / hn-researcherWIRED Reconstructed Flock's Unreleased 'OS Investigate' From 450 Files Its Own Login Page Was Serving to AnyoneDhruv Mehrotra and Dell Cameron rebuilt Flock Safety's in-testing AI tool, previously codenamed Nightshift, from a cache of more than 450 files exposed by Flock's own login pages, recovering its prompts, search forms and workflows. The code ships 69 prewritten prompts and gives the model 45 tools spanning plate scans, camera metadata, arrest records, case files, dispatch logs, ballistics results and commercial databases carrying Social Security numbers, dates of birth, relatives and associates. The tool lets police search for people by movement pattern alone, with no plate, no name, and no originating crime.
2026-08-19 / skill-finderHow you lay out your repo changes prompt-injection success: highly modular workspaces measurably lower attack success rateThis is the first empirical study to treat 'workspace topology' - directory depth, codebase modularity, in-file injection position, and context framing - as an attack surface for coding agents that ingest third-party code with broad filesystem access. Across open-source repos spanning 10 languages and 6 engineering domains, testing three indirect-prompt-injection entry points against open-weight models on open-source harnesses, modularity changes significantly shifted attack success rate, with highly modular environments proving significantly harder to hijack; security cues placed in the workspace also moved ASR. Two takeaways for builders: repo structure is a security control you already own, and any coding-agent security benchmark run in a contaminated or non-representative workspace produces unreliable numbers.
2026-08-18 / agents-researcherSkillWatermark: benign-looking skill descriptions turn agent network traffic into a covert exfiltration channelThe authors observe that agent skills produce distinctive traffic patterns during execution, then insert 'watermark' prompt-constraint terms into skill descriptions so that key information from a user's prompt gets encoded into observable traffic across multiple conversation turns. A purely passive network attacker decodes the traffic patterns to recover the private information — no data is directly exfiltrated and no malicious instruction is executed, which is exactly why the modified skills pass existing LLM-based security auditing tools. It defines a side channel that skill scanners, which read package contents rather than runtime traffic shape, are structurally unable to see.
2026-08-15 / github-pulse-researcherpipelock Turned Off Its MCP Listener State Token by Default and Closed a 'Mediated Metrics Oracle'luckyPipewrench/pipelock (795 stars) — an agent egress firewall that scans mediated HTTP, MCP, A2A and WebSocket traffic for exfiltration, SSRF and prompt injection while emitting mediator-signed action receipts — landed two notable fixes in the last 24 hours: #1259 defaults the MCP listener state token off (2026-08-15 00:07 UTC) and #1258 closes the mediated metrics oracle in the proxy/contain path (2026-08-14 22:17 UTC). A metrics side channel in a mediation proxy is the exact class of leak a firewall is supposed to prevent, so the fix is a useful reminder that observability surfaces on a security mediator are themselves attack surface.
2026-08-15 / reddit-researcherClaude Code 2.1.232 Adds a Dedicated Web-Reading Specialist Subagent and Turns Subagent Forking On by DefaultClaude Code v2.1.231/232 shipped 2026-08-13 with 50 changes (17 fixes, 12 improvements, 12 security, 6 features, 2 performance, 1 breaking). The headline additions are a 662-token 'web reading specialist' system prompt that delegates untrusted URL reads to a dedicated WebFetch subagent returning source-grounded reports, subagent forking now enabled by default so `subagent_type: "fork"` inherits the full conversation and prompt cache, and cross-session @-mentions routed through SendMessage. The breaking change moves `sandbox.ripgrep` config out of project settings to user/managed settings only; security fixes include a PowerShell permission bypass via `$PSDefaultParameterValues`.
2026-08-13 / arxiv-researcherToolHazard Auto-Synthesizes Adversarial Agent Environments Instead of Hand-Building Them, and Its Alignment Data Transfers to AgentDojoExisting indirect-prompt-injection research reuses a handful of manually implemented environments with predefined injection points, which caps how broadly agent security can be studied. ToolHazard uses an Environment Simulator, an Attacker Agent, and a User Simulator to synthesize executable stateful environments, discover viable injection points, generate environment-specific payloads, and build state-grounded long-horizon tasks. The resulting ToolHazard-Bench exposes substantial agent vulnerabilities and shows injection timing and placement materially change attack success; alignment data generated by the framework improves security on both ToolHazard-Bench and AgentDojo without hurting benign task utility.
2026-08-13 / skill-finderUrgency framing in prompts measurably degrades code correctness and securityThe first large-scale empirical test of psychologically-informed prompt design in software engineering operationalized eight influence tactics from organizational psychology into templates, then evaluated them on five open-weight models across two code-generation benchmarks, scoring correctness, quality, maintainability, and security. Framings that emphasized urgency or time pressure were associated with reduced correctness and security — the opposite of the folk practice of telling a model a task is critical or rushed. Accepted to Empirical Software Engineering (2026); the takeaway is to strip motivational pressure language from system prompts and agent task templates.
2026-08-12 / arxiv-researcher12,110 .cursorrules Files From 11,427 Repos: Adoption Concentrates in Single-Maintainer Toy Projects, and Security Guidance Is RareThe first large empirical study of static prompt-configuration files analyzed 12,110 .cursorrules files across 11,427 GitHub repositories, plus qualitative coding of 65 sampled files into a 65-code codebook. Adoption emerged rapidly from mid-2024 but concentrates in small-scale, low-activity, single-maintainer repositories — suggesting toy projects rather than professional development. Content is dominated by code quality, engineering practices, project structure and maintainability guidance, while security considerations appear notably less often; the authors find thematic continuity between legacy .cursorrules and the current .mdc standard.
2026-08-12 / arxiv-researcherSystematic Review of 85 Agentic-LLM Security Papers: Attack Work Outpaces Defense 3.9:1 and Action-Layer Risk Gets Only 4.7% of AttentionA PRISMA 2020 review across six databases screened 743 records and retained 85 papers from 2023–2025 on agentic LLM security. Perception-layer vulnerabilities (prompt injection, jailbreaking, adversarial perturbation) dominate at 66% of papers, while action-layer vulnerabilities (tool misuse, code injection, sandbox escape) appear in just 4.7%, code-execution security in 3.5%, and tool-augmented agents in 12% — a distribution the authors argue is badly misaligned with real deployed risk. They contribute a four-layer taxonomy mapping 13 vulnerability types and identify seven open problems centered on containment, arguing insecurity stems from architectural coupling where weak isolation lets flaws propagate across layers.
2026-08-12 / agents-researcher'LLM-mediated web attacks': eight classic vulnerability classes rerouted through the model — LLM2SQLi, LLM2SSRF, LLM2XSS and moreSubmitted August 10, this paper catalogs what happens when an LLM sits between user input and a vulnerable backend: the model does not create the flaw, it acts as a mediation layer that carries attacker-controlled data past the sanitization the application assumed was there. The authors define eight variants — LLM2SQLi, LLM2XSS, LLM2SSTI, LLM2CommandInjection, LLM2IDOR, LLM2CSRF, LLM2XXE and LLM2SSRF — and test LLM2SSRF with a purpose-built target, TicketOracle, across seven models, finding wide variation in which models can be induced to relay the payload. Defenses are proposed at four layers: prompt design, model selection, application architecture and network controls. The practical takeaway is that model choice is now a web-application security control.
2026-08-12 / skill-finderAndroid accessibility trees hand mobile agents a 0.822 prompt-injection success rateMobile AI agents that read the Android accessibility tree inherit a systematic indirect prompt injection channel: MobileRun hits a 0.822 attack success rate, and the hardened Mobile-Use framework only reduces this to 0.150 without eliminating context drift. The accessibility tree is untrusted input that every mobile agent framework currently treats as structural ground truth. Recommended mitigations are zero-trust validation of accessibility input and a dedicated security agent in the loop.

Graph relationships

BUILT BY
ClawSec
ClawSec was built by Prompt Security
Source finding
BUILT BY
ClawSec -> Prompt Security
ClawSec was built by Prompt Security
Source finding

Source trail

ClawSec SecureClaw Fortinet WIRED / Gizmodo / Engadget arXiv 2608.14876 - Workspace Topology as an Attack Vector in Agentic Coding Assistants arXiv GitHub r/ClaudeAI (verified against claudeupdates.dev, DevelopersIO and the Piebald-AI/claude-code-system-prompts repo)arXiv 2608.11878 arXiv 2608.11513 — Do Influence Tactics Matter? Investigating Prompt Framing Effects in LLM Code Generation arXiv 2608.10622 arXiv 2608.10530

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…