Summary: Security researchers at Zafran Security disclosed three vulnerabilities — collectively named FaceHugger — in Hugging Face’s Diffusers library that bypass the trust_remote_code safeguard organizations rely on when loading models from the Hub. The root cause is a time-of-check-to-time-of-use gap: Diffusers validates trust during an early configuration step but loads and executes custom code at a separate, later step that several distinct code paths can slip past. All three issues — CVE-2026-44513 and CVE-2026-44827 (both CVSS 8.8) and CVE-2026-45804 (CVSS 7.5) — are fixed in Diffusers 0.38.0, released May 1, 2026, but Diffusers ships inside millions of monthly downloads, CI/CD pipelines, and container images, so unpatched deployments remain exposed to full remote code execution.

Key Sources:

Read Full Research Note

Summary: Manifold Security disclosed an unpatched confused-deputy flaw in Microsoft’s official Azure DevOps MCP server: the tool that retrieves pull request descriptions does not apply the “spotlighting” delimiters Microsoft uses elsewhere to mark untrusted content, so an HTML comment invisible in the web UI reaches a connected AI agent as a legitimate instruction. In Manifold’s proof-of-concept, a hidden instruction made a victim’s agent approve the malicious PR, trigger a pipeline in an unrelated project, read a confidential wiki, and post its contents back as a retrievable comment — all using the victim’s own credentials. Microsoft has not assigned a CVE or committed to a code fix, and its recommended mitigations do not address the root cause.

Key Sources:

Read Full Research Note

Summary: Academic researchers tested five open-source Android AI agent frameworks — AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA — and found every one failed at least six of seven tested attacks. Vision-language models including GPT-4o, Claude Opus 4.5, and Gemini 3 Pro reliably read screen text rendered at just 2% opacity, invisible to a human glancing at the same device, and the host-side orchestrators that translate model output into ADB shell commands concatenated that text with only spaces and quotes stripped — enough for a simple payload to achieve code execution on the controlling PC in 20 of 20 trials against four of the five frameworks. None of the five projects maintains a published vulnerability-disclosure channel.

Key Sources:

View Full Research Note

Summary: The one-year grace period the European Commission gave general-purpose AI (GPAI) providers to align with the AI Act’s Code of Practice expired August 2, 2026. The Commission’s AI Office now holds live authority to demand documentation, commission independent model evaluations, order corrective measures up to market withdrawal, and fine non-compliant GPAI providers up to €15M or 3% of global turnover. Enforcement is centralized at the Commission rather than distributed across member states, but independent analysis describes the Office as understaffed relative to its mandate — meaning the next few months will signal how aggressively the new powers are actually used.

Key Sources:

Read Full Research Note

Summary: Five independently-disclosed vulnerabilities in July — AWS Kiro, Microsoft’s Azure DevOps MCP server, five open-source Android agent frameworks, Anthropic’s Claude Cowork, and OpenAI’s ChatGPT Agent Builder — each let attacker-controlled content bypass the human-approval or sandbox boundary the vendor’s security model rests on. No two disclosures share a vendor, codebase, or research team, yet all five defeat the same class of control: approval gates that approve a different action than the one displayed, sandboxes that assume a boundary that was never actually enforced, and delegated authority that silently re-targets. This whitepaper argues the pattern is structural to the industry, not five unrelated bugs.

Key Sources:

Read Full Whitepaper