The report
A medical AI model bundle can bring executable configuration into a trusted process before an inference ever starts. Two MONAI advisories examine different parts of that loading chain: whether bundled logging configuration runs code and whether the downloaded artifact was actually checked against a known digest.
Loading is an execution boundary
The logging advisory describes logging.config.fileConfig processing a bundle-supplied configs/logging.conf. Python handler expressions can be evaluated at workflow initialization, so the dangerous effect occurs on import rather than after a medical segmentation request. An attacker first needs a malicious or substituted bundle to reach that path. This is not evidence that legitimate hospital model files were compromised.
The integrity advisory describes a different failure. When check_hash received no expected hash, it could return success instead of reporting that no comparison was possible. Verifying nothing is not the same as verifying the artifact. A downloader can therefore display an apparently reassuring result even though its caller has not pinned the bytes to a trusted source.
The possible chain is not an observed incident
A modified artifact could exploit an unpinned download path and then reach executable logging configuration. That is a plausible composition of the two preconditions, not a proven campaign, patient-data breach or successful wrong diagnosis. The separate execution Case and integrity Case preserve their independent evidence and patch questions.
The advisories refer to remediation in MONAI 1.6.1, but the disclosed version metadata is inconsistent in places. Operators should confirm exact package artifacts and that every download call has a trusted expected digest, rather than relying on the success status of a hash-checking function or a version label alone.