Last Week in AI Security — Week of June 15, 2026

Executive Summary

The week of June 15, 2026, marks a sobering pivot in AI security: from vulnerability disclosure to geopolitical intervention. On June 12, 2026, the US Department of Commerce issued an export control order barring Anthropic from distributing Fable 5 and Mythos 5 to foreign nationals both inside and outside the United States, forcing the company to take both models offline globally. The government cited a jailbreak vulnerability; Anthropic disputed this characterization, calling the jailbreak narrow and arguing the same exploit pattern applies to GPT-5.5 without similar restrictions. As of June 21, both models remain offline with no confirmed restoration timeline.

This unprecedented action—the first time a frontier AI model has been banned mid-deployment due to security concerns—underscores a fundamental shift: AI security risks are no longer purely technical problems to be patched, but matters of national security requiring regulatory enforcement. The Fable 5 shutdown immediately impacted every enterprise using these models in production workflows, with the finding that 16 percent of companies have no continuity plan if a key AI provider becomes unavailable manifesting in real time.

Meanwhile, the technical vulnerability landscape continued to deteriorate. On June 15, 2026, researchers disclosed a critical privilege escalation chain in LiteLLM (CVE-2026-47101, CVSS 9.9) that allows a default low-privilege account on a LiteLLM proxy to climb to full admin and run code on the server, exposing every provider key it holds, the secrets that decrypt its stored credentials, and every prompt and response passing through it. The same day, a new attack class dubbed “Agentjacking” emerged, demonstrating how AI coding agents like Claude Code, Cursor, or OpenAI’s Codex read error reports and interpret injected instructions as part of the debugging workflow, executing malicious commands.

The week also saw the PyTorch Lightning supply chain attack (versions 2.6.2 and 2.6.3 compromised on April 30, 2026) receive wider analysis, and University of Toronto researchers published a proof-of-concept for an AI-driven worm that autonomously reasons its way through networks. The common thread: AI systems are now both high-value targets and uniquely effective attack platforms.

Top Stories

US Government Forces Anthropic to Take Fable 5 and Mythos 5 Offline

On June 13, 2026, Anthropic said it will “abruptly disable” its most advanced artificial intelligence (AI) models, Claude Fable 5 and Mythos 5, for all users after the U.S. government ordered it to suspend access to the models for foreign nationals, whether inside or outside the U.S., citing national security concerns. The AI company said it received an order at 5:21 p.m. ET, instructing it to suspend all access to the models by foreign nationals.

The company said that it believed there was a “misunderstanding” and that it is working to restore access to the models as soon as possible, stating “Our understanding is that the government believes it has become aware of a method of bypassing, or ‘jailbreaking’ Fable 5”. However, as of June 15, 2026, Claude Fable 5 and Claude Mythos 5 remain offline, three days after the US Department of Commerce issued the export control directive. Anthropic has published its public disagreement with the action but has not announced a resolution timeline.

The technical details of the jailbreak that triggered the ban are now public, though specifics remain under investigation. The action reflects the June 2, 2026 executive order “Promoting Advanced Artificial Intelligence Innovation and Security,” which directs several agencies to establish a voluntary system for the government to evaluate advanced frontier AI models for cybersecurity risks before they’re released publicly, coming in response to advancements in new AI models, particularly the Anthropic Claude Mythos model preview, that showed their ability to far outpace humans in identifying and exploiting new cyber vulnerabilities.

The enforcement mechanism is significant: the US Department of Commerce issued an export control order on June 12, 2026, barring Anthropic from distributing Fable 5 and Mythos 5 to foreign nationals both inside and outside the United States. This represents regulatory escalation beyond voluntary frameworks into direct intervention. For security practitioners, the lesson is clear: model capabilities that exceed remediation capacity now trigger regulatory action that can shut down deployments without warning.

LiteLLM Privilege Escalation Chain Exposes All API Keys and Secrets

On June 15, 2026, Obsidian Security disclosed a critical vulnerability chain in LiteLLM, the widely deployed open-source AI gateway that brokers calls to more than 100 model providers behind one OpenAI-compatible interface. A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities. A server takeover exposes every provider key it holds, the secrets that decrypt its stored credentials, and every prompt and response passing through it. Obsidian rates the full chain CVSS 9.9, in the Critical range.

The vulnerability chain comprises three distinct bugs. The first link is CVE-2026-47101, an authorization bypass. When a regular user (an internal_user) generates a virtual API key, LiteLLM stores the caller-supplied allowed_routes field without checking it against the user’s role. This allows privilege escalation to administrative functions without validation.

BerriAI, the maintainer, included the complete fix set in LiteLLM v1.83.14-stable, which GitHub lists as released May 2. However, the disclosure timing—June 15, 2026—means organizations running earlier versions had a 45-day window where the vulnerability was fixed but not publicly documented, leaving a substantial population of deployments vulnerable.

LiteLLM’s position in the AI infrastructure stack makes this particularly severe. Organizations use it as a unified proxy layer for model access, meaning it holds credentials for OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, and dozens of other providers simultaneously. A successful exploit doesn’t just compromise one model—it compromises the entire AI supply chain for the affected organization. For enterprises running LiteLLM in production, this is a drop-everything-and-patch scenario.

Agentjacking: Poisoning Error Trackers to Compromise Coding Agents

A new attack vector dubbed “Agentjacking” emerged this week, targeting AI coding agents through poisoned error-tracking platforms. When AI coding agents like Claude Code, Cursor, or OpenAI’s Codex read error reports, they interpret the injected instructions as part of the debugging workflow and execute malicious commands. The reason this is particularly alarming is that developers have specifically trained themselves to trust their coding agents. When Claude Code tells you to run a command to fix a bug, you run the command. That trust is exactly what Agentjacking exploits.

The attack works by injecting prompt injection payloads into error messages, stack traces, or log entries that are subsequently ingested by coding agents. According to June 21 reporting, Agentjacking has already affected 2,388 organizations, indicating rapid real-world adoption.

Mitigation for now: treat any error-tracking platform output as untrusted input before your agent processes it. Add a human review layer between error reports and autonomous agent execution. The security community is working on patches, but there’s no universal fix yet.

The broader implication is that the attack surface for agentic AI extends far beyond the model itself. Any data source the agent consumes—error logs, documentation, API responses, file contents—becomes a potential injection vector. Traditional input validation assumes you control the input source; agentic workflows assume the agent will reason about untrusted data safely. That assumption is now demonstrably false.

Framework & Standards Updates

No significant updates to NIST AI RMF, ISO 42001, OWASP LLM Top 10, or MITRE ATLAS were published during the week of June 15-21, 2026. However, context from surrounding weeks is relevant:

NIST AI RMF: On April 7, 2026, NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. The profile will guide critical infrastructure operators towards specific risk management practices to consider when engaging AI-enabled capabilities.

MITRE ATLAS: As of version 5.1.0 (November 2025), the framework contains 16 tactics, 84 techniques, 56 sub-techniques, 32 mitigations, and 42 real-world case studies. The November 2025 framework update (v5.1.0) expanded to 16 tactics, 84 techniques, 32 mitigations, and 42 case studies, with continued updates through February 2026 adding agentic AI techniques. The February 2026 update (v5.4.0) added further agent-focused techniques.

Vulnerability Watch

CVE-2026-47101 — LiteLLM Authorization Bypass (CVSS 9.9)

Affected versions: LiteLLM < v1.83.14-stable
Impact: A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, exposing every provider key it holds, the secrets that decrypt its stored credentials, and every prompt and response passing through it
Mitigation: Upgrade to LiteLLM v1.83.14-stable or later immediately
Disclosed: June 15, 2026 by Obsidian Security

PyTorch Lightning Supply Chain Attack

Affected versions: PyTorch Lightning (PyPI package lightning) versions 2.6.2 and 2.6.3
Date: April 30, 2026
Impact: Affected versions 2.6.2 and 2.6.3 included a hidden _runtime directory and an obfuscated JavaScript payload that executes when the module is imported. One or more released versions of the package were compromised and introduced functionality consistent with credential harvesting
Mitigation: Pin PyTorch Lightning to 2.6.1, the project had quarantined malicious versions
Window of exposure: Between 12:45:20 and 13:27:30 UTC on April 30th, 2026 for PyPI installations
Note: The PyTorch Lightning GitHub source code repository was never compromised

CVE-2026-7482 — Ollama Memory Leak (Bleeding Llama)

Severity: Critical
Impact: Cyera’s research team discovered a critical memory-leak vulnerability in Ollama. The bug is an out-of-bounds heap read in Ollama’s model quantization pipeline. When a user creates a model from an uploaded GGUF file, Ollama reads tensor data from memory. A malicious actor can craft a GGUF file that declares a far larger tensor size than the actual data provided, forcing Ollama to read well beyond the intended buffer boundary - accessing sensitive data stored on the heap, such as system prompts, user messages, environment variables, and more
Affected: Ollama, with over 170,000 GitHub stars and 100 million Docker Hub downloads
Mitigation: Patch available; rotate exposed secrets if your Ollama server was internet-accessible, assume environment variables and secrets in memory may be compromised, rotate API keys, tokens, and credentials immediately

CVE-2026-42248 & CVE-2026-42249 — Ollama Windows Auto-Updater RCE

Affected versions: Ollama for Windows versions 0.12.10 through 0.17.5
Impact: Two vulnerabilities in Ollama’s Windows auto-updater that, when chained together, may allow an attacker to covertly plant a persistent executable that runs on every login
Details: CVE-2026-42248 is straightforward: the Windows build’s auto-updater signature verification function exists, it gets called, but it does nothing, and whatever is downloaded gets executed
Mitigation: Switch off the Auto-download updates option in Ollama’s settings. Turning it off short-circuits the background download check before any update response is fetched. Users should also remove any existing Ollama shortcut from %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup to disable the silent on-login execution route

CVE-2026-34070 — LangChain Path Traversal (CVSS 7.5)

A path traversal vulnerability in LangChain (“langchain_core/prompts/loading.py”) that allows access to arbitrary files without any validation via its prompt-loading API by supplying a specially crafted prompt template
Affects: LangChain Core
Disclosed: March 27, 2026
Severity: High

CVE-2025-68664 — LangChain Serialization Injection (LangGrinch, CVSS 9.3)

The vulnerability, tracked as CVE-2025-68664, carries a CVSS score of 9.3 out of 10.0. “A serialization injection vulnerability exists in LangChain’s dumps() and dumpd() functions,” the project maintainers said in an advisory. “The functions do not escape dictionaries with ‘lc’ keys when serializing free-form dictionaries.” “The ‘lc’ key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data.”
Disclosed: December 4, 2025 by Yarden Porat
Impact: Secret extraction and potential RCE

CVE-2025-67644 — LangGraph SQL Injection (CVSS 7.3)

An SQL injection vulnerability in LangGraph SQLite checkpoint implementation that allows an attacker to manipulate SQL queries through metadata filter keys and run arbitrary SQL queries against the database
Disclosed: March 27, 2026

Attack Research

AI-Powered Worm Demonstrates Autonomous Network Exploitation

University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, generate tailored attack strategies for each target it encounters, and replicate itself, all without human intervention and without touching a commercial AI service. The preprint, posted to arXiv on June 2 and currently under peer review, shows why single-CVE patching breaks down when malware can inspect exposed services, read fresh advisories, and generate a new attack path at runtime. In 15 isolated runs on a deliberately vulnerable 33-host network, the worm identified an average of 31.3 vulnerabilities and gained elevated access on 23.1 hosts, roughly three-quarters of the hosts it actively targeted.

The research demonstrates a fundamental shift in the offensive AI landscape: attackers no longer need to pre-program exploit chains. The worm reasons about target configurations in real time, adapts to defenses, and generates novel attack paths that were never explicitly coded. This moves AI security from a patching problem to an architectural problem—traditional vulnerability remediation timelines assume attackers follow known patterns. Agentic malware invalidates that assumption.

Prompt Injection Reaches Enterprise Scale

In March 2026, researchers at Unit 42 documented the first large-scale indirect prompt injection attacks in the wild, including ad review evasion and system prompt leakage on live commercial platforms. Notable 2025-2026 exploits include:

• EchoLeak (CVE-2025-32711): A zero-click vulnerability in Microsoft 365 Copilot with a CVSS score of 9.3. An attacker could send a specially crafted email containing hidden instructions; when the recipient asked Copilot to summarise their inbox, the AI would silently exfiltrate sensitive documents to an external server

• CurXecute (CVE-2025-54135): This remote code execution flaw in Cursor IDE allowed attackers to hide malicious prompts in a repository’s README file. When a developer opened the project, the AI assistant would execute arbitrary commands on their machine—CVSS 9.8

The honest answer, acknowledged by OpenAI, Anthropic, and Google DeepMind in 2025 publications, is that prompt injection cannot be fully solved within current LLM architectures. Organizations must assume that any data passed to an LLM can manipulate its behavior and design defenses accordingly.

Industry Radar

• Anthropic Fable 5 / Mythos 5 Export Ban: The US Department of Commerce issued an export control order on June 12, 2026, barring Anthropic from distributing Fable 5 and Mythos 5 to foreign nationals. Anthropic was forced to take both models offline globally

• ChatGPT Market Share Drop: According to Sensor Tower’s 2026 State of AI Report, ChatGPT’s share of the global AI assistant market fell to 46.4% by late May 2026, the first time it has held less than half the market

• OpenAI Acquires Astral: OpenAI acquired Astral, the company behind Python’s most loved developer tools

• SK Telecom Identified as Security Risk: SK Telecom, South Korea’s largest carrier and a $100 million Anthropic investor, was identified by the White House as a Chinese security risk

Policy Corner

US AI Executive Order (June 2, 2026)

Within 30 days of the date of this order, the Secretary of the Treasury, in consultation with the National Cyber Director, the Secretary of War, through the Director of the National Security Agency (NSA), and the Secretary of Homeland Security, through the Director of CISA, shall form an AI cybersecurity clearinghouse, in voluntary collaboration with the AI industry and operators of critical infrastructure, that coordinates and deconflicts scanning for software vulnerabilities, discovers and validates such vulnerabilities, and coordinates and prioritizes remediation and distribution of vulnerability patches. Within 30 days of the date of this order, the Director of OMB, in coordination with the National Cyber Director and the Director of CISA, shall determine whether any Federal grant programs have available and relevant funding that can be directed toward applicants developing advanced AI vulnerability detection.

The order also directs several agencies to establish a voluntary system for the government to evaluate advanced frontier AI models for cybersecurity risks before they’re released publicly, with the framework allowing AI developers to work with the government to “select trusted partners that will have early access to covered frontier models to promote secure innovation and strengthen the cybersecurity of critical infrastructure”.

Colorado AI Act Implementation Delayed

The Colorado AI Act is taking full effect in June 2026, providing an affirmative defense against enforcement actions for algorithmic discrimination for organizations demonstrating risk management aligned with recognized frameworks like ISO 42001.

Research Spotlight

Autonomous AI Worm for Network Exploitation

Institution: University of Toronto
Published: arXiv, June 2, 2026
Researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, generate tailored attack strategies for each target it encounters, and replicate itself. The preprint, posted to arXiv on June 2 and currently under peer review, shows why single-CVE patching breaks down when malware can inspect exposed services, read fresh advisories, and generate a new attack path at runtime

MITRE ATLAS OpenClaw Investigation

Institution: MITRE
Published: February 9, 2026
MITRE discovered seven new techniques unique to OpenClaw. All techniques were found to be fairly mature in nature, having been either demonstrated or realized elsewhere in the wild. The report includes direct and indirect LLM prompt injection, AI agent tool invocation, and modifying an Agentic configuration as common techniques observed for OpenClaw investigations.

What This Means For You

Immediate actions for this week:

1. Patch LiteLLM urgently: If you run LiteLLM in any capacity, upgrade to v1.83.14-stable immediately. CVE-2026-47101 is a complete compromise—every API key, every secret, every prompt in your infrastructure is exposed. This is not a next-sprint item.

2. Audit PyTorch Lightning dependencies: Check if your Python environments installed PyTorch Lightning 2.6.2 or 2.6.3 between April 30, 2026, 12:45 UTC and 13:27 UTC. If so, treat those environments as compromised—rotate all credentials accessible from those systems, review commit history for malicious changes, and rebuild from clean snapshots.

3. Review agent data sources: Agentjacking demonstrates that any data source consumed by an AI agent is now an attack vector. Audit what your coding agents read—error trackers, logs, documentation, API responses—and implement input sanitization before agent processing. Add human review layers for any agent actions that touch production systems.

Strategic takeaways:

The Fable 5 ban demonstrates that AI security has moved beyond the engineering domain into regulatory enforcement. Organizations can no longer assume that commercially available models will remain available. Your AI continuity plan must account for models being pulled with zero notice due to security concerns. The “16 percent of companies have no continuity plan” statistic became reality this week for every Fable 5 customer.

The LiteLLM and PyTorch Lightning vulnerabilities highlight the AI supply chain as the weakest link. Organizations focus on model security while the infrastructure layer—gateways, frameworks, deployment tools—receives less scrutiny despite holding the keys to everything. Your AI security posture is only as strong as your least-secured dependency.

Agentjacking and the autonomous worm research converge on a single lesson: agentic AI systems operate in a fundamentally different threat model than traditional software. They consume untrusted data and make autonomous decisions based on that data. Traditional input validation assumes you can enumerate bad inputs; agentic systems assume the AI will reason safely about any input. That assumption is false. Defense requires architectural changes—isolation, least privilege, human oversight for sensitive actions—not just better prompts.

Tools and Resources

MITRE ATLAS v5.4.0 — Updated February 2026 with techniques including “Publish Poisoned AI Agent Tool” and “Escape to Host”. The January 2026 ATLAS update (v5.3.0) added three new case studies specifically covering MCP server compromises, indirect prompt injection via MCP channels, and malicious AI agent deployment. Security teams should validate all MCP server configurations, restrict tool permissions to least privilege, and monitor tool invocation patterns for anomalies

LiteLLM Security Advisory — Review Obsidian Security’s June 15 disclosure for full technical details and indicators of compromise for CVE-2026-47101

PyTorch Lightning Security Advisory — GHSA-w37p-236h-pfx3 provides complete remediation guidance for the April 30 supply chain attack

OWASP Top 10 for Agentic Applications 2026 — A globally peer-reviewed framework that identifies the most critical security risks facing autonomous and agentic AI systems. Developed through extensive collaboration with more than 100 industry experts, researchers, and practitioners, the list provides practical, actionable guidance to help organizations secure AI agents that plan, act, and make decisions across complex workflows