Stories This Week
- Top Story — Microsoft's Project Perception enters public preview today: Microsoft announced Project Perception on July 27, and it enters public preview inside Defender today.
- The Hugging Face intrusion ran through at least eight flaws in JFrog Artifactory, and there's a patch waiting.: Artifactory is the warehouse companies use to store and serve their software components.
- Hugging Face published how it investigated an AI-run attack, and the hardest part wasn't the attacker.: The intrusion started with a malicious dataset that abused two code-execution paths in the company's data-processing pipeline.
- Nearly 900,000 AI assistant add-ons scanned, thousands malicious.: ESET's threat report for the six months ending May 2026 looked at the "skills" people install to extend AI assistants, the equivalent of browser extensions, and found tens of thousands that were suspicious and thousands that were outright malicious.
- A critical-severity flaw in an AI agent toolkit has now gone five months with no fix.: The command injection bug in ModelScope's MS-Agent framework, rated 9.8 out of 10, has been public since March and still has no patch available.
- Three vendors shipped specialist security models within eight days, and each decided differently who may use it.: Google released Gemini 3.5 Flash Cyber on July 21, which Google says can find, validate and patch vulnerabilities.
- More than 70 organisations joined the Open Secure AI Alliance, and NVIDIA said plainly what triggered it.: NVIDIA convened the group on July 27 to build security AI that defenders can inspect, run themselves and adapt.
- Congress introduced the AI Kill Switch Act.: The bipartisan bill from Representatives Ted Lieu and Nathaniel Moran would give the Homeland Security Secretary authority, in consultation with the Commerce Secretary and the Director of National Intelligence, to order an AI system capable of "catastrophic harm" slowed down or shut off.
- Europe's AI rules became enforceable on August 2.: A point worth getting right, because a lot of coverage doesn't: the obligations on providers of the largest general-purpose AI models have been legally applicable since August 2025.
- Cyera agreed to buy Oasis Security for roughly $1 billion.: Cyera secures company data.
- Onyx Security raised $113 million four months after leaving stealth.: The round was led by Bessemer Venture Partners and values the Israeli company at an estimated $640 million, four months after it emerged from stealth with $40 million.
- Sound is now an attack surface.: A new paper on stealthy concurrent audio prompt injection shows attackers hiding instructions inside audio aimed at AI assistants that listen as well as read, reporting an average 69.10% attack success rate against Gemini 3 Pro.
- You can poison what an agent remembers.: The FARMA research targets an agent's stored reasoning history rather than the documents it looks up, forging the record of how it previously thought about a problem.
- Agents can be hijacked through data they were told to trust.: Researchers demonstrated agent data injection against tools developers use daily, including Claude Code, Codex and Gemini CLI.
- The AI Summit at Black Hat USA (August 4): a full-day AI security track in Las Vegas; Black Hat Briefings run August 5-6.
- DEF CON 34 AI Village (August 6-9): the practitioner counterpart, with the HalCTF competition and hands-on adversarial AI demos..
Curator's Corner
Three security models landed in eight days, and they didn't land in the same shape. Google gated a broad cyber model to governments and trusted partners. Cisco published small models with open weights, free to download, aimed at the narrow job of pointing at the file where a flaw probably lives. Microsoft embedded a specialist model inside a larger system of agents. That isn't three companies racing toward the same product. It's security capability arriving by three different routes at once: restricted access, open weights, and an integrated agent system.
What none of this week's announcements hands entirely to the model is the decision to take a consequential action unattended. Before an agent isolates a server, something has to answer questions no benchmark tests. Is that box carrying payroll tonight? Has traffic already failed over, or is this the last healthy node? Who owns the exception if the answer is no? Can this be undone in thirty seconds, or does it need a change window and two approvers? A benchmark score for finding vulnerabilities tells you nothing about whether the surrounding system can answer any of that.
Which is where I'd put the effort, and it's more specific than "collect more data." Split it in two. State and dependencies tell an agent what is happening and what else breaks if it acts. Decision rights and rollback tell it whether it is allowed to and how the action gets undone. The first half is an observability problem and the industry is decent at it. The second half isn't a data problem at all, and no amount of telemetry produces it, because an agent cannot infer authority from signals. Someone has to write down which actions are permitted, under which business conditions, with what reversal path. The missing layer isn't another asset graph. It's organisational authority made executable.
Hugging Face ran into the same missing layer from the opposite direction. When its team investigated the intrusion on its own systems, the providers' controls couldn't establish that the person submitting attacker commands was the one authorised to be studying them, so the work was refused. The question wasn't only what the model could do. It was whether this requester had the standing to ask. That is decision context too, and nobody had encoded it.