Synthesis history

Brave documented indirect prompt injection in Perplexity Comet [^37605], giving the AI browser attack class — previously a research demonstration against unnamed systems — a specific named commercial product. Industry s…

The substantively new item this pass is the June 30 Ars Technica report on a 'false reality' attack class against AI browsers [^37039], which extends the structural guardrail critique to a new product category: research…

The Five Eyes advisory received broad mainstream amplification (CBS News, CNN, Democracy Now, Australian TV) but new coverage items carry no claims or quotes beyond what was already established at launch. The substantiv…

New items are primarily additional media coverage of the Five Eyes warning and OpenAI Daybreak, with no substantive new claims beyond those captured at launch. The main addition is the official NSA press release (33818)…

The Five Eyes alliance issued a public warning on June 23 that AI models capable of severe attacks could arrive within months [^33122] — the first official intelligence-community statement in this thread, added as a new…

OpenAI's Daybreak launch on June 22 is the major new development: GPT-5.5-Cyber achieves 85.6% on CyberGym — the highest single-model score measured and above Mythos 5 — with Trusted Access for Cyber agreements across s…

Item 30137 adds a maximum-critical Copilot vulnerability disclosed June 16 allowing 2FA code theft via prompt injection, with Ars Technica framing prompt injection as structurally unfixable — the most substantive new de…

All nine new items (28681–28689) are secondary coverage of the Google Outsider Enterprise lawsuit already documented as item 28098 in the prior synthesis — no new claims, facts, or perspectives emerged. The Gemini phish…

The Outsider Enterprise lawsuit [^28098] adds a concrete operational case of Gemini being weaponized for phishing-as-a-service at scale — 300 templates, 2.5M texts, 9,000 fake sites — directly illustrating the attacker …

The Cloud Security Alliance's gap analysis [^28004] partially answers the previously open question about MITRE ATLAS agentic coverage — it confirms ATLAS also lacks coverage for autonomous agentic orchestration, not jus…

This pass adds documentation confirming three distinct SafeBreach Gemini bypasses — voice/audio injection [^27221] alongside the previously noted calendar-invite [^27222] and WhatsApp [^24407] techniques — updating the …

Five significant additions this pass: Anthropic's FRT empirical report on 832 banned attackers documenting a 1.7-fold increase in medium-to-high risk actors and identifying a MITRE ATT&CK gap for agentic orchestration […

Three significant new incidents this pass: the Meta AI support chatbot exploited for Instagram account takeovers via direct request with no technical skill required [^23237][^23242]; a developer deliberately embedding a…

The axios npm compromise has moved from 'potential expansion' to confirmed, with a CISA advisory and multiple vendor analyses [^3823][^5903][^15192][^21680], though a new ambiguity has emerged: the CISA advisory is date…

The most substantive new development is Simon Willison's May 26 documentation of a concrete data exfiltration vulnerability in shipping Microsoft Copilot Cowork via prompt injection [^21198] — the most direct evidence t…

The most significant new development is Huntress's documentation of an axios npm compromise [^5451] — axios is among the most downloaded JavaScript libraries in history, and if confirmed as part of Mini Shai-Hulud, it w…

The most significant new development is Socket.dev's identification of a phishing attack against npm author 'Qix' as the campaign's initial access vector [^18868] — the first concrete attribution of how Mini Shai-Hulud …

The dominant new development is CSO Online's report that Lapsus$ has joined the extortion wave targeting the campaign's supply chain victims [^17393], introducing a second named threat actor and raising unresolved quest…

The dominant new developments are: CERT-EU's official confirmation that the European Commission breach exposed data across 30 EU institutions [^15923][^15924], resolving the prior pass's open question about EU confirmat…

The dominant new developments in this pass are: Nx Console version 18.95.0 specifically identified as the GitHub breach vector (previously described only as 'poisoned VS Code extensions') [^13298][^13300][^13301]; CISA'…

The dominant change in this pass is the confirmation of the GitHub breach: what was an unverified social-media claim in the prior synthesis is now confirmed by GitHub, The Record, Dark Reading, InfoWorld, and others — w…

The most significant additions are three named AI infrastructure victims beyond OpenAI and Mistral AI — LiteLLM, Telnyx, and Guardrails AI [^9230][^9232][^9235] — and the formal assignment of CVE-2026-33634 at CVSS 9.4,…

The most significant new development is the identification of the threat actor as TeamPCP and the expanded scope of the Mini Shai-Hulud campaign: 160+ npm and PyPI packages were compromised (not just TanStack), and Mist…

Three interlocking developments in May 2026 are forcing a reckoning with AI as both an offensive weapon and a vulnerable target. • Claude Mythos Preview became the first AI model to autonomously clear both UK AISI end-t…