Artificial intelligence is increasingly being adopted by Kenyan organisations for research, automation, data analysis, customer engagement and software development.
This growth introduces a new cybersecurity concern: the AI software supply chain.
Critical vulnerabilities have been identified in the _Hugging Face diffusers_ library, including CVE-2026-44827 and CVE-2026-44513, both rated CVSS 8.8, together with CVE-2026-45804.
The weaknesses could allow a malicious model repository to execute code when loaded into an affected environment.
Kenyan developers, universities, technology companies and organisations operating AI or machine-learning platforms should therefore avoid treating downloaded models as harmless data.
Affected environments should be upgraded to version 0.38.0 or later, while organisations should verify the origin of models, review dependencies and separate experimental AI workloads from sensitive production systems.
As Kenya expands its use of artificial intelligence, secure development and supply-chain management must become part of normal cybersecurity practice.