#23: Security is getting agentic. Context decides whether it acts.

Top Story: Microsoft's Project Perception enters public preview today — Microsoft announced Project Perception on July 27, and it enters public preview inside Defender today. The Hugging Face intrusion ran through at least eight flaws in JFrog Artifactory, and there's a patch waiting. — Artifactory is the warehouse companies use to store and serve their software components. Hugging Face published how it investigated an AI-run attack, and the hardest part wasn't the attacker. — The intrusion started with a malicious dataset that abused two code-execution paths in the company's data-processing pipeline. Nearly 900,000 AI assistant add-ons scanned, thousands malicious. — ESET's threat report for the six months ending May 2026 looked at the "skills" people install to extend AI assistants, the equivalent of browser extensions, and found tens of thousands that were suspicious and thousands that were outright malicious. A critical-severity flaw in an AI agent toolkit has now gone five months with no fix. — The command injection bug in ModelScope's MS-Agent framework, rated 9.8 out of 10, has been public since March and still has no patch available. Three vendors shipped specialist security models within eight days, and each decided differently who may use it. — Google released Gemini 3.5 Flash Cyber on July 21, which Google says can find, validate and patch vulnerabilities. More than 70 organisations joined the Open Secure AI Alliance, and NVIDIA said plainly what triggered it. — NVIDIA convened the group on July 27 to build security AI that defenders can inspect, run themselves and adapt. Congress introduced the AI Kill Switch Act. — The bipartisan bill from Representatives Ted Lieu and Nathaniel Moran would give the Homeland Security Secretary authority, in consultation with the Commerce Secretary and the Director of National Intelligence, to order an AI system capable of "catastrophic harm" slowed down or shut off. Europe's AI rules became enforceable on August 2. — A point worth getting right, because a lot of coverage doesn't: the obligations on providers of the largest general-purpose AI models have been legally applicable since August 2025. Cyera agreed to buy Oasis Security for roughly $1 billion. — Cyera secures company data. Onyx Security raised $113 million four months after leaving stealth. — The round was led by Bessemer Venture Partners and values the Israeli company at an estimated $640 million, four months after it emerged from stealth with $40 million. Sound is now an attack surface. — A new paper on stealthy concurrent audio prompt injection shows attackers hiding instructions inside audio aimed at AI assistants that listen as well as read, reporting an average 69.10% attack success rate against Gemini 3 Pro. You can poison what an agent remembers. — The FARMA research targets an agent's stored reasoning history rather than the documents it looks up, forging the record of how it previously thought about a problem. Agents can be hijacked through data they were told to trust. — Researchers demonstrated agent data injection against tools developers use daily, including Claude Code, Codex and Gemini CLI. The AI Summit at Black Hat USA (August 4) — a full-day AI security track in Las Vegas; Black Hat Briefings run August 5-6. DEF CON 34 AI Village (August 6-9) — the practitioner counterpart, with the HalCTF competition and hands-on adversarial AI demos.. Curator's Corner: The Model Decides What. Context Decides Whether. Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-08-03.html