vendor-breach-cascade

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The workflow ingests vendor-provided breach notification text (e.g., breach_description, vendor contact details) via the runtime trigger “Summit receives breach notification from a vendor (processor)”, and that vendor-authored free text is then stored/used in the agent’s context (e.g., in BreachCascadeRecord.vendor_notification and timeline details), which is outsider-authored content.