← Back to Last Week in AI
Week of June 8 2026

Last Week in AI Security — Week of June 8, 2026

Amazon CEO raises Anthropic security concerns; vLLM suffers sixth critical CVE; OpenAI authentication bypass discovered.

Key Highlights

  • Amazon CEO voices security concerns over Anthropic models to Trump administration
  • vLLM hit with sixth critical vulnerability in five months amid exposure epidemic
  • OpenAI API authentication bypass disclosed (CVE-2026-0257)
  • Harvey achieves ISO 42001 certification, first legal AI vendor with formal AIMS audit
  • NIST releases Critical Infrastructure AI RMF Profile; MITRE ATLAS continues agentic expansion

Executive Summary

The week of June 8, 2026, signals a maturation inflection point in AI security governance—even as the vulnerability disclosure pipeline shows no signs of slowing. While previous weeks documented the collapse of the theory-to-exploit gap, this week reveals how security concerns have escalated from engineering teams to the C-suite and, in one notable case, directly to the White House.

On June 14, 2026, Amazon’s CEO, Andy Jassy, raised concerns about the potential security implications of advanced AI models developed by Anthropic during discussions with officials from the Trump administration. The timing is significant: Amazon is Anthropic’s largest investor and cloud infrastructure provider, yet Jassy’s intervention suggests internal risk assessments have reached levels that warrant external regulatory attention. This marks the first documented case of a major cloud provider escalating AI model security concerns directly to federal authorities regarding a portfolio company.

On the framework and standards front, on April 7, 2026, NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure, extending the Risk Management Framework into sector-specific guidance for energy, healthcare, and transportation operators. Meanwhile, Harvey has achieved ISO 42001 certification, the leading internationally recognized standard specifically designed for AI management systems, becoming the first legal AI vendor to complete a third-party audit of its Artificial Intelligence Management System (AIMS). The certification represents a shift from voluntary frameworks to auditable compliance in high-stakes AI deployments.

The vulnerability landscape remains severe. vLLM, the high-throughput LLM serving framework with over 3 million monthly downloads, continues to dominate CVE disclosures. Recent advisories include an SSRF Protection Bypass (March 26, 2026), OpenAI API Auth Bypass (March 9, 2026), and critical Server-Side Request Forgery in MediaConnector (June 2, 2026), representing the sixth, seventh, and eighth critical vulnerabilities in the framework since January 2026. The velocity and severity of these disclosures underscore systemic architectural security gaps in the inference layer that repeated patches have failed to resolve.

Top Stories

Amazon CEO Escalates Anthropic Security Concerns to White House

On June 14, 2026, Amazon’s CEO, Andy Jassy, raised concerns about the potential security implications of advanced AI models developed by Anthropic during discussions with officials from the Trump administration. While specific technical details were not disclosed, the intervention represents an unprecedented escalation of AI security concerns from corporate governance to federal policy channels.

The context matters: Amazon is Anthropic’s primary investor and provides the AWS infrastructure underpinning Anthropic’s model training and deployment. Jassy’s public concern—raised with administration officials rather than handled through internal risk management—suggests Amazon’s internal assessments have identified risks that cannot be mitigated through commercial or contractual means alone.

This development follows directly from the Trump administration’s June 2 executive order establishing a voluntary framework for frontier model review. The Secretary of the Treasury, in partnership with other agencies, must form an AI cybersecurity clearinghouse to coordinate identification, validation, and remediation of software vulnerabilities. Jassy’s intervention appears designed to ensure Anthropic’s models receive federal scrutiny under this new framework, even though participation remains voluntary.

The timing also coincides with Anthropic’s April announcement that it was limiting the release of its Mythos Preview model due to its ability to identify and exploit software security vulnerabilities—a capability that triggered the original executive order. Whether Jassy’s concerns relate to Mythos specifically, subsequent model capabilities, or broader systemic risks in Anthropic’s development pipeline remains unclear.

For security practitioners, the lesson is clear: even the most sophisticated AI companies with world-class security teams and infrastructure providers are encountering model capabilities that exceed their ability to manage risk through conventional controls. When your cloud provider escalates concerns about your models to the White House, risk has moved beyond the technical domain into the political.

vLLM Vulnerability Epidemic Continues: Sixth Critical CVE in Five Months

vLLM, the open-source high-throughput serving framework with over 3 million monthly downloads, has become the most actively exploited component in the AI infrastructure stack. Recent security advisories include SSRF Protection Bypass (March 26, 2026), OpenAI API Auth Bypass (March 9, 2026), and a critical Server-Side Request Forgery in MediaConnector published June 2, 2026, adding to an already extensive list of critical remote code execution and authentication bypass vulnerabilities disclosed since January 2026.

The pattern is consistent: each CVE targets a different layer of vLLM’s architecture—video processing, authentication, SSRF protections, and pickle deserialization—suggesting systemic security design gaps rather than isolated implementation bugs. CVE-2026-25960 (CVSS 7.1, disclosed March 9, 2026) shows that the security problems persist, as a parser differential between urllib3 and yarl in load_from_url_async enables SSRF protection bypass.

The operational reality is stark: Oligo Security discovered thousands of exposed ZeroMQ sockets on the public internet, all of them bound to vLLM inference clusters. These exposures are not theoretical. CVE-2026-22778 allows an attacker to achieve Remote Code Execution (RCE) simply by sending a malicious video link to a vLLM API. Organizations running video-capable models on vLLM without network segmentation or authentication are effectively running unauthenticated RCE endpoints.

The broader implication: CVE-2025-30165 (CVSS 8.0) enables RCE via unsafe pickle deserialization in vLLM’s multi-node ZeroMQ communication; Oligo Security’s research revealed the same vulnerable code pattern replicated across inference frameworks at Meta, NVIDIA, and Microsoft; vLLM has since mitigated this vector by making the V1 engine the default. Deployers still running the V0 engine—which many production environments are, given breaking API changes—remain exploitable.

For practitioners: if you are running vLLM in production, treat it as a critical vulnerability surface requiring network isolation, mandatory authentication, input validation proxies, and continuous CVE monitoring. The disclosed vulnerabilities are not edge cases—they target core functionality in default configurations.

LangChain Triple-CVE Disclosure Exposes Secrets, Files, and Databases

Three critical vulnerabilities disclosed on March 27, 2026 turned LangChain and LangGraph from trusted enterprise AI frameworks into active attack surfaces. The disclosure, which went largely unnoticed outside security circles until June, represents one of the most severe enterprise AI security events of the year.

CVE-2026-34070 (CVSS score: 7.5) is a path traversal vulnerability in LangChain that allows access to arbitrary files without any validation via its prompt-loading API; CVE-2025-68664 (CVSS score: 9.3) is a deserialization of untrusted data vulnerability in LangChain that leaks API keys and environment secrets; CVE-2025-67644 (CVSS score: 7.3) is an SQL injection vulnerability in LangGraph SQLite checkpoint implementation.

The vulnerabilities chain into a unified kill chain. Prompt injection leads to file read, which leads to credential theft, which leads to RCE; patching alone is insufficient; architectural controls are required to prevent the next class of similar vulnerabilities. An attacker controlling user input to a LangChain application can read /etc/passwd, exfiltrate LLM API keys from environment variables, and query the LangGraph checkpoint database—all through a single malicious document or API input.

With over 60 million combined weekly downloads across PyPI, LangChain and LangGraph represent foundational dependencies in thousands of production AI applications. The impact extends beyond direct exploitation: The development comes days after a critical security flaw impacting Langflow (CVE-2026-33017, CVSS score: 9.3) has come under active exploitation within 20 hours of public disclosure; the vulnerability shares the same root cause as CVE-2025-3248, and stems from unauthenticated endpoints executing arbitrary code.

Organizations running LangChain applications must upgrade to version 1.2.22 or later immediately, audit all prompt loading code paths, validate inputs against fixed schemas, and treat all serialized LangChain objects from untrusted sources as RCE vectors.

Framework & Standards Updates

NIST AI RMF Critical Infrastructure Profile Released

On April 7, 2026, NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. The introduction of AI RMF Profiles tailors the framework to specific sectors and risk environments; NIST’s concept note highlights sector-specific risk considerations for energy, healthcare, transportation, and emphasizes safety, resilience, and system reliability; this signals a broader move toward contextualized AI risk management.

The profile extends the base AI RMF 1.0 framework with binding requirements for operators of critical infrastructure, integrating national security and operational continuity concerns into AI governance. The NIST AI RMF Playbook was updated June 10, 2026.

ISO 42001 Adoption Accelerates

Harvey has achieved ISO 42001 certification, the leading internationally recognized standard specifically designed for AI management systems. Harvey’s certification as the first legal AI vendor represents a significant market signal: enterprise buyers are no longer evaluating AI vendors solely on model performance, but on whether those systems can be audited and trusted in critical workflows.

While not yet a harmonized standard in the Official Journal, ISO 42001 provides the structural foundation for the Article 17 Quality Management System required for high-risk AI providers under the EU AI Act; Colorado AI Act provides an affirmative defense against enforcement actions for algorithmic discrimination for organizations that can demonstrate a risk management program aligned with a recognized framework like ISO 42001.

OWASP Agentic Applications Top 10 Gains Adoption

The OWASP Top 10 for Agentic Applications 2026 is a globally peer-reviewed framework that identifies the most critical security risks facing autonomous and agentic AI systems. Released in December 2025, the framework is now being integrated into security testing workflows alongside the established OWASP LLM Top 10. The 2026 OWASP Top 10 for Agentic Applications addresses the emerging security challenges of autonomous AI systems.

MITRE ATLAS Expands Agentic Coverage

The October 2025 update through Zenity Labs collaboration added 14 new agent-focused techniques, followed by the November 2025 v5.1.0 release that expanded the framework to 16 tactics with 84 techniques; the February 2026 v5.4.0 update added further techniques including “Publish Poisoned AI Agent Tool” and “Escape to Host.”

The 2026 update shifts focus from model-centric attacks to execution-layer exposure; threat modeling now must account for autonomous workflow chaining, delegated authority persistence, and API-level orchestration risk.

Vulnerability Watch

CVE-2026-24747: PyTorch weights_only RCE (CVSS 8.8)

A vulnerability in PyTorch’s weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(…, weights_only=True), can corrupt memory and potentially lead to arbitrary code execution; version 2.10.0 fixes the issue.

This vulnerability is particularly concerning because weights_only=True was explicitly designed as a security control to prevent unsafe deserialization. When a victim loads a specially crafted checkpoint file using torch.load(…, weights_only=True), the vulnerable deserialization mechanism can be exploited to execute arbitrary code on the target system; this vulnerability is particularly concerning in machine learning workflows where model checkpoints are frequently shared between researchers.

Affected versions: All PyTorch versions prior to 2.10.0
Mitigation: Upgrade to PyTorch 2.10.0 or later immediately. Audit all model checkpoint sources and treat third-party .pth files as untrusted executables.

PyTorch Lightning Supply Chain Attack (April 30, 2026)

On April 30, 2026, members of the open source community alerted maintainers to a supply chain security incident affecting PyPI-distributed versions of pytorch-lightning 2.6.2 and 2.6.3; the attack targeted the distribution layer, not the source code. The incident was detected and resolved within 42 minutes, but highlights ongoing supply chain risks in ML package ecosystems.

vLLM: Multiple Critical Vulnerabilities

Mitigation: Update to the latest vLLM version. Deploy behind authentication proxies. Isolate inference workloads in dedicated network segments. Monitor for CVE announcements weekly.

LangChain/LangGraph Triple Disclosure (March 27, 2026)

  • CVE-2026-34070 (CVSS 7.5): Path traversal enabling arbitrary file read
  • CVE-2025-68664 (CVSS 9.3): Deserialization flaw leaking API keys and secrets
  • CVE-2025-67644 (CVSS 7.3): SQL injection in LangGraph checkpoint database

Affected versions: LangChain < 1.2.22, LangGraph checkpoint implementations
Mitigation: Upgrade immediately. Validate all user inputs against fixed schemas. Do not load prompts or serialized objects from untrusted sources.

Industry Radar

  • Anthropic filed a draft S-1 registration document with the US SEC on June 1st, completing a Series-H funding round that valued it at $965 billion just days before the filing.

  • Microsoft has integrated Anthropic’s Claude Opus 4.8, Sonnet 4.5, and Haiku 4.5 into the Microsoft Foundry catalogue, with a new “Claude in Excel Agent Mode” allowing users to invoke Claude from within spreadsheets.

  • The Gentlemen ransomware used infostealer credentials, AI tools, and affiliates to hit 483 victims across 66 countries in under a year; The Gentlemen surfaced as a ransomware operation in September 2025 and by June 13, 2026 had listed 483 victims on their dark-web leak site, 380 of them in 2026 alone.

Policy Corner

Colorado AI Act Takes Effect June 30, 2026

The CAIA requires risk management for AI-driven decisions in employment, housing, and healthcare and will be implemented as of June 30, 2026 (delayed from February 1, 2026). Organizations deploying high-risk AI systems in Colorado must implement documented risk management processes by the end of this month.

Treasury Department Financial Services AI RMF Released

The Treasury Department’s Financial Services AI RMF, released February 2026, translates NIST principles into 230 control objectives specifically for financial institutions. The framework is not mandatory, but the FTC, CFPB, FDA, SEC, and EEOC all cite framework principles when evaluating whether AI practices meet reasonable standards of care.

AI Executive Order Implementation Deadlines Approaching

Within 60 days of the EO (by August 1, 2026), the Director of the Office of Personnel Management must expand the United States Tech Force Information Cybersecurity Specialist hiring and placement pathways. Federal agencies must also deliver on benchmarking processes for assessing frontier model cyber capabilities by the same deadline.

Research Spotlight

No major academic papers or preprints directly related to AI security were published this week that had not already been covered in previous digests. Research activity appears focused on implementing and testing the frameworks released earlier in 2026 (OWASP Agentic Top 10, MITRE ATLAS v5.4.0) rather than net-new threat discovery.

The academic community’s June focus has shifted to the upcoming Real World AI Security conference at Stanford (June 23-25, 2026) and the Global Conference on AI, Security and Ethics at UNIDIR in Geneva (June 18-19, 2026), both of which will feature presentations on 2026’s most impactful attack techniques and defense strategies.

What This Means For You

Immediate Actions (This Week)

  1. Patch PyTorch and vLLM immediately. CVE-2026-24747 (PyTorch) and the ongoing vLLM CVE stream represent exploitable RCE vectors in default configurations. Upgrade PyTorch to 2.10.0+ and vLLM to the latest release. Audit all model checkpoint sources.

  2. Update LangChain/LangGraph dependencies. If you use LangChain or LangGraph in production, upgrade to LangChain 1.2.22+ this week. The triple-CVE disclosure enables file read, secret exfiltration, and database compromise through a single malicious input.

  3. Audit vLLM and Ollama deployments for public exposure. Thousands of inference endpoints remain exposed to the public internet without authentication. If you bind vLLM or Ollama to 0.0.0.0, you are running an unauthenticated API surface. Deploy authentication proxies (OAuth, API keys) and restrict network access immediately.

Strategic Priorities (Next 30 Days)

  1. Prepare for Colorado AI Act compliance (June 30 deadline). If you deploy AI systems making decisions about Colorado residents in employment, housing, or healthcare contexts, you must have documented risk management processes in place by June 30, 2026. ISO 42001 or NIST AI RMF alignment provides a defensible framework.

  2. Assess whether your models require voluntary federal review. The Trump administration’s voluntary frontier model review framework is now operational. If your organization develops models with advanced cyber capabilities, assess whether voluntary submission for federal benchmarking reduces your regulatory and reputational risk—especially if you have stakeholders (investors, cloud providers) who may escalate concerns independently.

  3. Integrate MITRE ATLAS v5.4.0 into threat models. The February 2026 update added agentic techniques including “Publish Poisoned AI Agent Tool” and “Escape to Host.” If you deploy autonomous agents with tool access, update your threat models to account for execution-layer attacks, not just prompt injection.

Long-Term Posture

The pattern is clear: vulnerabilities in the AI inference and orchestration layer are being discovered and exploited faster than organizations can patch. Defense-in-depth is no longer optional. Network segmentation, mandatory authentication, input validation proxies, runtime monitoring, and continuous CVE tracking are baseline requirements for production AI deployments—not optional hardening measures. Organizations treating AI infrastructure with the same security rigor applied to payment processing or authentication systems will fare better than those treating it as experimental R&D infrastructure.

Tools and Resources