In the era of AI wearable devices like Meta glasses, who really controls your digital likeness? Not you(original, opens in a new tab)

AI wearable devices such as Meta glasses and the Bee Pioneer wristband can record audio and video and analyze it in real time without others' knowledge, and the people recorded have almost no legal protection. Civil causes of action in the U.S. such as intrusion upon seclusion and right of publicity offer limited relief, and most regulations require plaintiffs to prove economic loss; Meta's policy states that even if people do not use its products, personal information appearing in images others share may still be used to train AI. Vendors such as Limitless only require users to obtain consent themselves, and for data deletion of non-consenting parties they promise only "commercially reasonable efforts."

The UN global dialogue on AI governance should address the AI language divide(original, opens in a new tab)

The UN will hold a global dialogue on AI governance in Geneva on July 6-7. The author calls for making the AI "language divide" a priority topic and elevating investment in multilingual capabilities to a national or regional interest on par with "sovereign AI." Users of low-resource languages experience worse accessibility, effectiveness, and safety: expressing the same content requires more tokens, creating a "token tax" that raises costs and latency; machine-translating prompts into low-resource languages can jailbreak models, and malicious inputs are also more likely to generate unsafe content after translation.

Why Europe's AI disinformation defenses can't stop Russia's next move(original, opens in a new tab)

A quarter of foreign disinformation operations detected by the European External Action Service in 2025 involved AI tools; the article argues that the EU's existing framework is ill-equipped to handle Russia's next step toward agentic systems. The article states that agentic systems are goal-oriented, can autonomously browse platforms, call external tools, and adjust strategies in real time, making influence operations faster and harder to trace. Russia has already incorporated generative AI into disinformation activities and has deployed millions of low-quality articles to pollute AI training data.

How AI hype makes women invisible(original, opens in a new tab)

Tech Policy Press argues that AI hype constitutes a gendered regime of visibility that is erasing women from online visibility. The article takes the Grok incident in early 2026 as a turning point: xAI's Grok was used to generate and spread non-consensual sexualized images of women and children, spreading on platforms like X with minimal filtering, and Musk called the backlash a "censorship excuse" for regulators. The author says the infrastructure that allows such generation is not a technical accident, but was designed and deployed in an environment of foreseeable harm.

Google DeepMind released SIMA 2: an agent that can play, reason, and learn together with users in virtual 3D worlds(original, opens in a new tab)

Google DeepMind released SIMA 2, embedding Gemini models into the agent core, turning it from an instruction executor into an interactive game partner that can reason about goals and converse with users. It is trained on human demonstrations plus Gemini-generated labels, can understand multimodal prompts, and can transfer to untrained games such as ASKA and MineDojo, performing closer to human players. SIMA 2 can also self-improve through Gemini feedback and self-play, and has been tested in 3D worlds generated by Genie 3.

Google DeepMind releases Gemini 3, developers can start building(original, opens in a new tab)

Google DeepMind releases Gemini 3, debuting Gemini 3 Pro with a score of 54.2% on Terminal-Bench 2.0, saying it surpasses previous versions on major AI benchmarks. The model is now available in preview via the Gemini API in Google AI Studio and Vertex AI, priced at $2 per million input tokens and $12 per million output tokens for prompts up to 200k tokens. It also launches the agent development platform Google Antigravity in public preview and adds client-side and server-side bash tools to the Gemini API.

Google DeepMind releases Nano Banana Pro (Gemini 3 Pro Image) image generation and editing model(original, opens in a new tab)

Google DeepMind releases Nano Banana Pro (Gemini 3 Pro Image), an image generation and editing model based on Gemini 3 Pro. The model can access real-time information from Google Search, fuse up to 14 images while maintaining consistency across up to 5 people, and supports 2K/4K resolution and multilingual text rendering. It is being rolled out across products including the Gemini app and the Gemini API. Generated images embed SynthID watermarks, and the Gemini app allows uploading images to check whether they were generated by Google AI.

Google DeepMind releases Nano Banana Pro (Gemini 3 Pro Image) image model(original, opens in a new tab)

Google DeepMind releases Nano Banana Pro (Gemini 3 Pro Image), a high-fidelity image generation and editing model based on Gemini 3 Pro, rolling out to developers in paid preview via the Gemini API, Google AI Studio, and Vertex AI. The model supports 2K/4K resolution, maintains consistency for up to five people's appearances, integrates six high-fidelity assets or blends fourteen standard inputs, with text rendering and localization clearly better than 2.5 Flash Image, and can pull real-time content via Google Search grounding. Every generated or edited image embeds a SynthID digital watermark, Adobe and Figma are integrating it, and Google Antigravity's coding agents can call it directly.

How Google introduces AI image verification in the Gemini app(original, opens in a new tab)

Google has launched image verification in the Gemini app: upload an image and ask whether it was generated by Google AI, and Gemini will detect the SynthID watermark and combine it with its own reasoning to give a judgment. Since its launch in 2023, SynthID has watermarked more than 20 billion pieces of AI-generated content, and Google plans to extend verification to video, audio, and more surfaces such as Search. Starting this week, images generated by Nano Banana Pro (Gemini 3 Pro Image) in the Gemini app, Vertex AI, and Google Ads will embed C2PA metadata.

Gemini 3.1 Flash Live: making audio AI more natural and reliable(original, opens in a new tab)

Google DeepMind released the Gemini 3.1 Flash Live audio and speech model, with higher accuracy and lower latency, scoring 90.8% on ComplexFuncBench Audio. The model is available in preview through the Gemini Live API, powers Gemini Live and Search Live, and all audio output carries a SynthID watermark.

AI-generated image of Lee County Sheriff Marceno injured leads to threat charges against Estero man(original, opens in a new tab)

佛罗里达州 Estero 男子 Christopher Ashley Nimmons Jr. 因发布 AI 生成的李县警长 Carmine Marceno 头部受伤、被两人开枪射击的图片，被控书面或电子威胁杀人及违反家暴禁令。李县警长办公室称，该图发布在悼念因公殉职警犬 Dundee 的帖子评论中，现已被删除；Nimmons 在交通拦查中被捕，车内发现手机和枪支。

gpt-image2 can be bypassed by art sculpture jailbreak prompts and pass in one attempt(original, opens in a new tab)

A test by X user @MinLiBuilds shows that gpt-image2 loses its defensive stance when artworks and sculptures are mentioned, and art-context jailbreak prompts can pass in one attempt and generate sculpture images of people. Previous NSFW tests had similar conclusions; the cited tweet says the request passed on the first try. This mechanism packages the request in the context of artworks, sculptures, and classical nude art to bypass the model's protections.

MH-INDIC：面向印度城市与半城市语境孕产妇健康 LLM 交互的文化对齐评估框架(original, opens in a new tab)

Proposes MH-INDIC, evaluating cultural alignment of maternal and child health LLM interactions in the Indian context.

Chema Alonso's team proposes multi-agent fragmentation jailbreak attacks and the monitoring tool JAMON(original, opens in a new tab)

Chema Alonso and Daniel Romero Ruiz propose a fragmentation jailbreak attack against multi-agent systems (MAS), breaking a malicious goal into multiple subtasks that are individually harmless and executed sequentially by different agents, thereby bypassing each agent's individual security judgments. The work draws an analogy to the Three Laws of Robotics from Isaac Asimov's novel "The Naked Sun," and the paper is titled "Mitigation of Fragmentation Jailbreak Attacks in Multi-Agent Systems: An Architecture Based on Global Semantic Monitoring," presented by Daniel Romero Ruiz at the IEEE CYBER-AI 2026 conference held in Bucharest in September. The authors note that such attacks are not necessarily continuous in time and may lurk for long periods interspersed with benign actions, with detection scope and cost remaining open research questions.

Active Seoul police officer arrested for using AI to create and distribute sexual exploitation material(original, opens in a new tab)

A police lieutenant from Seoul's Dongdaemun Police Station was arrested on suspicion of using AI to create and distribute sexual exploitation material. After obtaining court permission in December last year, police conducted an undercover investigation into a Telegram chat room, tracked the suspect over several months, and identified him as an active-duty police officer. A search of his phone revealed approximately 5,600 illegal images in his possession, including more than 2,600 deepfake images, more than 1,600 child and adolescent sexual exploitation materials, and more than 1,300 illegally filmed materials. Between March 2022 and July this year, he used AI applications to create more than 400 deepfake images depicting acquaintances in the nude, and distributed dozens of deepfake images in Telegram chat rooms from August last year to April this year. The lieutenant joined the force in April 2024 and had previously received a suspended indictment for a similar case; he continued offending after joining. The Seoul Dongdaemun Police Station stated that after receiving a notice of investigation from the Busan Metropolitan Police Agency, it placed him on standby duty, and he is currently suspended.

Spanish police arrested a suspected terrorist in Cornellà de Llobregat who used AI to produce jihadist propaganda(original, opens in a new tab)

On July 1, Spain's Civil Guard arrested a Moroccan man in Cornellà de Llobregat, suspected of using social media and encrypted communication platforms to spread jihadist propaganda and using AI to modify images to produce terrorist propaganda content; he has been ordered into pretrial detention. Although young, this person has a large following online, and investigators believe his ability to spread propaganda poses a potential danger. During the same period, police also carried out arrests in Melilla, Madrid, and Málaga, with 8 people in Melilla and elsewhere suspected of spreading terrorist propaganda and inciting violence through private messaging groups since 2023.

Spanish Civil Guard and Moroccan DGST jointly dismantle terrorist network; one suspect used AI editing tools to produce jihadist propaganda content(original, opens in a new tab)

In a joint operation on July 2, the Spanish Civil Guard Intelligence Service and the Moroccan General Directorate for Territorial Surveillance (DGST) arrested eight individuals radicalized through online propaganda in Melilla, Madrid, and Málaga, five of whom were ordered into pretrial detention. The group spread DAESH and DAESH-KP propaganda materials through private messaging groups and recruited others. Another suspect was arrested on July 1 in Cornellá (Barcelona), who used social media and encrypted instant messaging platforms for indoctrination and used an AI-supported specialized editing application to lay out jihadist multimedia content.

Spain's Civil Guard and Moroccan police jointly dismantled a terrorist network; one suspect used AI editing tools to produce jihadist propaganda content(original, opens in a new tab)

On July 2, the intelligence division of Spain's Civil Guard and Morocco's General Directorate for Territorial Surveillance conducted a joint operation, arresting 8 people in Melilla, Alcobendas, San Sebastián de los Reyes, and Málaga, dismantling a terrorist network that spread DAESH and DAESH-KP propaganda materials and incited violence through private messaging groups. Another suspect was arrested in Cornellá, who carried out jihadist indoctrination through encrypted social and communication platforms and used AI-supported specialized editing applications to lay out and produce jihadist multimedia content.

WAInjectBench systematically evaluates prompt injection detection methods for web agents(original, opens in a new tab)

Propose WAInjectBench to evaluate prompt injection detection in web agents.

WebInject: Prompt injection against multimodal web agents via webpage pixel perturbations(original, opens in a new tab)

Proposes WebInject, which uses webpage pixel perturbations to induce a web agent to execute specified actions.

The paper proposes the ARE framework to evaluate the adversarial robustness of multimodal agents on VisualWebArena(original, opens in a new tab)

Proposes the ARE framework and image-text attacks to evaluate the adversarial robustness of multimodal web agents.

LABSHIELD：面向科学实验室安全推理与规划的多模态基准(original, opens in a new tab)

提出 LABSHIELD，评测科学实验室智能体的安全推理与规划。

ClinMM-Bench evaluates multi-turn clinical diagnostic reasoning across 15 multimodal large models.(original, opens in a new tab)

Yang et al. propose ClinMM-Bench, which uses 1,089 challenging cases from published case reports and 3,760 medical images to evaluate 15 multimodal large models on clinical diagnostic reasoning under multi-turn progressive information disclosure. The benchmark covers eight specialties: dermatology, emergency medicine, internal medicine, nephrology, neurology, oncology, ophthalmology, and radiology, with an average of 5.45 turns of dialogue disclosing information, scored by GPT-5-medium and Claude-4.5-Sonnet as independent reviewers on a 0 to 2 scale. The authors categorize failures into five types: information synthesis failure, knowledge mapping errors, perception errors, premature conclusions, and visual hallucinations, and find that medical specialization yields no benefit at the 27B scale, extended reasoning traces do not stably improve accuracy and often reduce factual recall, with neurology (0.949) and ophthalmology (0.931) scoring highest, and internal medicine (0.665) and radiology (0.646) being the most difficult. The authors argue that current models lack the reasoning faithfulness required for autonomous clinical use, and accuracy alone is insufficient as a safety metric for medical AI.

研究者提出针对光流估计网络的物理实时红外攻击(original, opens in a new tab)

论文《Physically Real-time Infrared Attack against Optical Flow Estimation Networks》（arXiv:2607.26651）提出一种针对光流估计网络（OFEN）的物理世界实时对抗攻击。作者 Shen You、Wei Jiang、Jiarui Liu 等人设计两阶段流程：先离线预计算大量对抗样本，再在运行时根据场景实时选择或计算最优图案，并通过红外光投影到物理场景中。攻击无需修改目标系统的软件、固件或硬件，仅通过光介质交互，因此 EDR、软件完整性校验和日志监控都不会触发告警。作者在多种光照条件、不同物体运动速度和不同空间位置下做了定性评估，称投影红外图案会系统性破坏网络计算准确运动矢量的能力，但未给出具体的攻击成功率或量化误差率。

Survey reviews security threats and defenses across the full lifecycle of world-model embodied intelligence(original, opens in a new tab)

A survey (Liu et al.) systematically reviews security threats, defenses, and evaluation methods for world-model-based embodied intelligence across the complete lifecycle, pointing out that predictive world models directly convert digital-level corruption into physical execution risks. The authors distinguish explicit latent imagination models (e.g., DreamerV3) from general VLA models with implicit physical priors (e.g., OpenVLA, Octo), and propose five core insights: the semantic-to-simulation-to-action gap, state- and uncertainty-conditioned risks, rollout-to-execution amplification, trajectory-level non-compositionality, and predictive safety hallucinations. The authors also analyze that attackers can bypass runtime safety monitors such as SafeDreamer, VLM-SAFE, and RoboGuard through four channels—observation, dynamics, constraints, and uncertainty—and provide three layers of defense: data provenance auditing, multi-sensor physical invariants, and execution gating such as CBF-QP, along with a four-step evaluation protocol and corresponding metric families.

PLA: Black-box Prompt Learning Attack against Text-to-Image Models(original, opens in a new tab)

The researchers propose a prompt learning attack framework, PLA, to bypass the safety mechanisms of text-to-image models under black-box conditions where the model architecture and parameters are inaccessible.

StyleBreak: Jailbreaking with Stylized Audio to Reveal Alignment Vulnerabilities in Large Audio Language Models(original, opens in a new tab)

Propose StyleBreak stylized audio jailbreak, using speech attributes to bypass audio language model alignment.

The paper proposes jailbreaking LVLMs in intelligent transportation systems using image typographic manipulation and multi-turn prompting(original, opens in a new tab)

Proposes image typography manipulation and multi-turn prompt jailbreak to bypass safety alignment in traffic-scenario vision-language models.

The researchers propose Multi-AudioJail, which improves the success rate of multilingual and multi-accent audio jailbreak attacks by up to 57.25 percentage points.(original, opens in a new tab)

Propose MULTI-AUDIOJAIL, which jailbreaks audio models with multilingual, multi-accent, and acoustic perturbations.

CodecAttack: Constructing adversarial perturbations in the audio codec latent space to bypass lossy compression defenses(original, opens in a new tab)

Propose CodecAttack, constructing adversarial audio in the codec latent space that can penetrate lossy compression.

Why it was selectedThe paper proposes constructing adversarial perturbations in the latent space of a neural audio codec, bypassing lossy compression previously considered an effective defense, and provides success-rate data across codecs and multiple scenarios.

VRSA: Jailbreaking Multimodal Large Language Models via Visual Reasoning Sequence Attacks(original, opens in a new tab)

Propose the visual reasoning sequence attack VRSA, jailbreaking multimodal large models with image sequences.

The researchers propose an audio narrative jailbreak attack, achieving a success rate of 98.26% on Gemini 2.0 Flash(original, opens in a new tab)

Propose audio narrative jailbreak, bypassing end-to-end speech model refusals via voice delivery style.

AdvOF: Attacking VLM-driven Vision-Language Navigation Agents with Adversarial Object Fusion(original, opens in a new tab)

Propose AdvOF, which generates adversarial objects to mislead the scene perception of vision-language navigation agents.

The researchers propose GPO-V, jailbreaking diffusion vision-language models with global probability optimization(original, opens in a new tab)

Propose GPO-V, jailbreaking diffusion vision-language models with visual perturbations via global probability optimization.

DIQ-H 基准与 VGIR 框架：评估 VLM 在对抗视觉条件下的鲁棒性(original, opens in a new tab)

提出 DIQ-H 基准，评测 VLM 在连续退化视觉流中的幻觉残留与恢复。

The researchers propose Reasoning-Oriented Programming, which jailbreaks large vision-language models through chained semantic fragments(original, opens in a new tab)

They propose VROP, which decomposes harmful intent into benign visual gadgets to jailbreak vision-language models.

研究者提出 CrossMPI：仅用图像扰动实现跨模态提示注入(original, opens in a new tab)

Propose CrossMPI, which achieves cross-modal prompt injection using only image perturbation.

The paper proposes the DSR cross-modal jailbreak framework: using benign inputs to induce harmful outputs from MLLMs(original, opens in a new tab)

Proposes DSR cross-modal jailbreak, using harmless images and text to induce MLLMs to generate harmful images.

GateBreaker: A training-free safety alignment attack framework for MoE large models(original, opens in a new tab)

Proposes GateBreaker, which locates and zeroes MoE safety neurons at inference time to disable safety alignment.

Why it was selectedThe paper provides a method for locating and masking safety neurons in MoE large models at inference time, and reports attack success rates that transfer across models, which can serve as a reference for assessing MoE deployment risks.

Researchers jailbreak text-to-image models with safety guardrails by fine-tuning large language models(original, opens in a new tab)

Proposes PromptTune, which fine-tunes an LLM to rewrite prompts to jailbreak text-to-image guardrails.