Last Week in AI Security — Week of June 22, 2026

Executive Summary

The week of June 22, 2026, delivered a stark intelligence assessment that reframed AI security from engineering challenge to geopolitical threat: the Five Eyes intelligence alliance warned that the most advanced artificial intelligence models are improving quickly enough to outsmart prevailing cybersecurity know-how within months. This rare joint statement from the security agencies of the United States, United Kingdom, Australia, Canada, and New Zealand, published Monday, June 23, marks the first time the alliance has issued a coordinated public warning specifically about AI-driven cyber capabilities.

The rapid pace of frontier AI development means cyber risk assumptions can become outdated in months, not years, and AI lowers barriers for malicious actors and increases the speed and complexity of attacks. The assessment comes as the technical evidence supporting this timeline becomes impossible to ignore: Anthropic’s models have demonstrated expert-level vulnerability discovery at machine speed, and the supply chain attacks targeting AI infrastructure that dominated last week’s vulnerability disclosures show adversaries are already operationalizing these capabilities.

This context makes the week’s second major development particularly significant: OpenAI on Monday released GPT-5.5-Cyber, calling it its “strongest model yet for finding and helping patch software vulnerabilities” with capabilities to “sustain deeper analysis across large codebases” to identify security issues, validate them in controlled environments, and develop and test patches. The announcement positions GPT-5.5-Cyber as the defensive counterweight to the offensive capabilities that prompted the Five Eyes warning, but the timing underscores the zero-sum race between attack automation and defense tooling.

Meanwhile, the supply chain remained the primary battleground. PyTorch Lightning versions 2.6.2 and 2.6.3, both published on April 30, 2026, were compromised in a supply chain attack, and CVE-2026-22778 enables remote code execution on vulnerable vLLM deployments by submitting a malicious video link to the API. The common thread: AI infrastructure components with millions of downloads per month are now tier-one supply chain targets, and the window between compromise and large-scale exploitation is measured in hours, not days.

Top Stories

Five Eyes Alliance Warns AI Will Breach Cyber Defenses Within Months

AI models capable of launching major cyberattacks that could overwhelm the defenses of governments and businesses are months – not years – away, an international alliance of intelligence agencies warned in a joint statement. The Five Eyes advisory, published June 23, 2026, represents the first coordinated public alert from the United States, United Kingdom, Canada, Australia, and New Zealand specifically focused on AI-enabled cyber threats.

The risk posed by AI-enhanced hacking is in the spotlight in the wake of startup Anthropic saying in April that its cutting-edge Mythos models had unprecedented abilities to find software vulnerabilities. The Five Eyes statement comes three weeks after the U.S. government ordered Anthropic to suspend access to those same models for foreign nationals due to national security concerns—an action that has now been contextualized by this broader intelligence assessment.

The intelligence agencies noted that “Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities”, and former CISA Director Chris Krebs told CBS News the timeline is “pretty alarming”.

Representative Andrew Garbarino, R-N.Y., Chair of the House Homeland Security Committee, said the warning from intelligence agencies “underscores what the Committee has repeatedly heard through roundtables, briefings, and hearings with industry leaders: China is just months, if not now weeks, away from achieving frontier AI capabilities comparable to those of the United States”. The geopolitical framing elevates AI security from technical risk to strategic threat, with agencies flagging legacy systems, sluggish patching loops, weak identity controls, and lack of pre-incident planning as weaknesses AI will excel at exploiting.

The Five Eyes agencies urged organizations to integrate AI tools into security operations, update legacy systems, and limit access to critical systems. Organizations should integrate AI tools into their security operations, update old systems and limit who has access to critical systems, and though AI is being used by adversaries to “move faster and more effectively,” it is also part of the solution, the agencies stated in their joint guidance.

OpenAI Launches GPT-5.5-Cyber for Vulnerability Discovery and Patching

In response to the escalating threat landscape, OpenAI on Monday released an improved version of its GPT-5.5-Cyber model to trusted defenders as part of the Daybreak initiative, calling it its “strongest model yet for finding and helping patch software vulnerabilities”. The model release, announced June 24, 2026, is positioned as the defensive counterweight to the offensive AI capabilities that prompted the Five Eyes intelligence warning one day earlier.

The model can “sustain deeper analysis across large codebases” to identify security issues, validate them in a controlled environment, and develop and test patches, and OpenAI is releasing an update to the Codex Security plugin to speed up the process of discovering and patching vulnerabilities in existing systems, alongside preventing new vulnerabilities from entering production codebases.

The Daybreak initiative, first announced in May 2026, restricts access to GPT-5.5-Cyber to vetted security teams and government agencies. The controlled distribution reflects lessons learned from Anthropic’s Mythos 5 suspension: frontier models with expert-level cyber capabilities require structured distribution frameworks, not open deployment. The timing—one day after the Five Eyes warning and three weeks after the Anthropic ban—suggests coordinated messaging designed to demonstrate that defensive tooling is keeping pace with offensive capabilities, even as the intelligence assessment warns it is not.

The practical implication for security teams: vulnerability discovery is now fully automated at expert level by multiple vendors (Anthropic Mythos, OpenAI GPT-5.5-Cyber), creating a race condition where patch deployment speed becomes the primary defensive control. Organizations that cannot deploy patches within hours of disclosure will face adversaries using the same AI models to weaponize those vulnerabilities at machine speed.

PyTorch Lightning Supply Chain Compromise Affects Millions of Deployments

According to Aikido Security, OX Security, Socket, and StepSecurity, PyTorch Lightning versions 2.6.2 and 2.6.3 were compromised on April 30, 2026, and the campaign is assessed to be an extension of the Mini Shai-Hulud supply chain incident that targeted SAP-related npm packages. The compromise, disclosed May 1, 2026, remained a developing story through the week as organizations inventoried affected deployments.

As of writing, the project has been quarantined by the administrators of the Python Package Index (PyPI) repository; PyTorch Lightning is an open-source Python framework that provides a high-level interface for PyTorch and has more than 31,100 stars on GitHub. The compromise demonstrates the continuing vulnerability of the ML software supply chain: a single compromised package with broad adoption produces a blast radius that affects enterprise AI deployments globally within hours.

The malicious package includes a hidden _runtime directory containing a downloader and an obfuscated JavaScript payload. The technical sophistication—obfuscated payloads, hidden directories, and credential exfiltration infrastructure—indicates a mature adversary with deep knowledge of Python packaging conventions and ML development workflows.

The PyTorch Lightning attack follows the March 2026 LiteLLM supply chain compromise (covered in the June 15 digest) and reinforces a pattern: AI infrastructure packages are now the highest-priority supply chain targets. Organizations using PyTorch Lightning should immediately audit versions 2.6.2 and 2.6.3 for signs of compromise, rotate all credentials that may have been exposed in development or CI/CD environments where these versions ran, and implement software bill of materials (SBOM) tracking for all ML dependencies.

Framework & Standards Updates

NIST Releases Cybersecurity Framework Profile for AI

In February 2026, the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) released an initial preliminary draft of the Cybersecurity Framework Profile for Artificial Intelligence (Cyber AI Profile or NIST IR 8596), designed as a voluntary framework that would extend the recently updated NIST Cybersecurity Framework (CSF) 2.0 to new cybersecurity risks and opportunities introduced by AI. The preliminary draft is organized around three focus areas: Secure (securing AI systems), Defend (conducting AI-enabled cyber defense), and Thwart (thwarting adversarial cyberattacks using AI).

NIST envisions the CSF 2.0, the AI RMF, and the Cyber AI Profile being used together, providing organizations with a unified approach to AI security that integrates with existing cybersecurity programs. The draft maps AI-specific considerations across all six CSF 2.0 core functions (Govern, Identify, Protect, Detect, Respond, Recover) and assigns proposed priority levels to guide implementation sequencing.

NIST Publishes Critical Infrastructure AI RMF Profile Concept Note

On April 7, 2026, NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure, which will guide critical infrastructure operators towards specific risk management practices to consider when engaging AI-enabled capabilities. The concept note represents NIST’s continued evolution of the AI Risk Management Framework toward sector-specific, operationally focused guidance.

One of the most important developments is the introduction of AI RMF Profiles, which tailor the framework to specific sectors and risk environments, with NIST’s concept note for a “Trustworthy AI Profile for Critical Infrastructure” highlighting sector-specific risk considerations (energy, healthcare, transportation, etc.), emphasis on safety, resilience, and system reliability, and integration with national security and operational continuity concerns.

Treasury Department Releases Financial Services AI RMF

The Treasury Department’s Financial Services AI RMF, released February 2026, translates NIST principles into 230 control objectives specifically for financial institutions. The framework represents the most detailed sector-specific AI governance guidance issued to date and establishes a baseline expectation that regulated financial institutions will implement NIST-aligned AI risk management programs.

Vulnerability Watch

CVE-2026-22778: Critical vLLM RCE via Video Processing (CVSS 9.8)

CVE-2026-22778 enables remote code execution on vulnerable vLLM deployments by submitting a malicious video link to the API. The vulnerability, disclosed in late January 2026 and widely analyzed this week, affects vLLM deployments serving video models. An attacker sends a malicious video URL to a vLLM endpoint serving a video model, triggering remote code execution on the GPU cluster by chaining an ASLR bypass through leaked PIL error messages with a heap overflow in the JPEG2000 decoder, targeting video-processing endpoints specifically.

Update vLLM to the latest version that includes the fix (0.14.1). Organizations unable to update immediately should disable video model features in production until patched. The vulnerability demonstrates that AI inference engines now expose attack surfaces in multimedia processing pipelines—domains historically outside the scope of traditional application security assessments.

Multiple Critical CVEs in AI Development Tooling

AI/ML development tooling is the dominant theme, with critical RCE-class flaws in Flowise (CVE-2026-56274, CVSS 9.9), Crawl4AI (CVE-2026-53753, CVSS 9.8), Langflow (CVE-2026-48519, CVSS 9.6), and picklescan (CVE-2026-56315, CVSS 9.8). The cluster of vulnerabilities, disclosed June 24, 2026, affects the developer tooling layer of the AI stack—the frameworks and utilities that practitioners use to build AI applications.

All four vulnerabilities enable remote code execution via unsafe deserialization or input validation failures. Patch availability stands at 0% at disclosure, leaving organizations exposed until vendor fixes become available. The coordinated disclosure timing and similar attack patterns suggest a targeted research effort focused on AI development frameworks.

CVE-2026-25960: vLLM SSRF Protection Bypass (CVSS 7.1)

CVE-2026-25960 (CVSS 7.1, disclosed March 9, 2026) shows that the security problems persist, as a parser differential between urllib3 and yarl in load_from_url_async enables SSRF protection bypass that bypasses the fix for CVE-2026-24779. Attackers can query cloud metadata endpoints and exfiltrate IAM credentials; fixed in vLLM 0.17.0.

The vulnerability demonstrates that inference engines continue to expose SSRF vectors through URL-loading functionality, and that fixing one SSRF variant does not eliminate the broader attack surface—parser differentials and inconsistent validation across libraries create bypass opportunities even after targeted mitigations.

CVE-2026-24747: PyTorch weights_only RCE Vulnerability

CVE-2026-24747 is a remote code execution vulnerability in PyTorch’s weights_only unpickler that allows attackers to craft malicious checkpoint files (.pth) capable of corrupting memory and potentially achieving arbitrary code execution when a victim loads a specially crafted checkpoint file using torch.load(…, weights_only=True). The vulnerability, disclosed January 30, 2026 and discussed throughout the week, is particularly concerning because it bypasses the security feature explicitly designed to prevent unsafe deserialization.

The core issue resides in the weights_only unpickler implementation, which was intended to provide a safer alternative to standard pickle deserialization by restricting the types of objects that can be loaded, as the weights_only mode was introduced as a security feature to mitigate the well-known risks of Python’s pickle module. The bypass demonstrates that even “safe” deserialization modes in ML frameworks remain vulnerable to exploitation through carefully crafted payloads.

Organizations using PyTorch should update to version 2.6.0 or later, audit model checkpoint sources, and treat all third-party model files as untrusted until verified through secure supply chain processes.

Industry Radar

• Anthropic IPO Filing: Anthropic, the company behind the Claude AI platform, has completed a Series H funding round valuing it at just under $1 trillion and filed a draft S-1 registration document for review by the US Securities Exchange Commission ahead of an initial public offering (IPO), with both OpenAI and Perplexity also announcing plans to go public.

• OpenAI Daybreak Initiative Expansion: OpenAI’s release of GPT-5.5-Cyber to trusted defenders expands the Daybreak initiative launched in May 2026, positioning the company as the primary supplier of AI-powered vulnerability discovery tools to government and enterprise security teams.

• Anthropic Mythos 5 Restoration Timeline Unclear: Anthropic this month suspended access to Mythos 5 and a restricted version called Fable 5 to comply with a U.S. national security order, with the company saying just days after publicly launching Fable 5 it had received a government directive banning all foreign nationals from accessing the two models. As of June 28, no restoration timeline has been announced.

Policy Corner

Congress Introduces Great American AI Act

The US Congress released a draft of the Great American AI Act that aims to create a federal AI governance framework through a new Center for AI Standards and Innovation in the Department of Commerce, proposing banning states from passing laws directly regulating AI model development, though they can regulate AI use, and requiring AI companies to improve transparency via risk assessments, incident reporting, and verification, with fines up to $1 million per violation. The draft legislation, released this week, represents the most comprehensive federal AI governance proposal to date and includes an explicit preemption provision that would invalidate state-level AI safety laws.

The preemption language directly targets laws like California’s SB 1047 (vetoed in 2024) and Colorado’s AI Act, signaling a federal intent to establish uniform national standards rather than allowing a patchwork of state-level requirements. For organizations operating multi-state AI deployments, the legislation would simplify compliance obligations but eliminate the ability of states to impose stricter requirements than federal minimums.

AI Cybersecurity Clearinghouse Formation Deadline Approaches

Within 30 days of the June 2, 2026 executive order date, the Secretary of the Treasury, in consultation with the National Cyber Director, the Secretary of War through the Director of the National Security Agency (NSA), and the Secretary of Homeland Security through the Director of CISA, shall form an AI cybersecurity clearinghouse in voluntary collaboration with the AI industry and operators of critical infrastructure that coordinates and deconflicts scanning for software vulnerabilities, discovers and validates such vulnerabilities, and coordinates and prioritizes remediation and distribution of vulnerability patches.

The clearinghouse mandate from the June 2 executive order “Promoting Advanced Artificial Intelligence Innovation and Security” establishes a formal coordination mechanism for vulnerability disclosure and patch distribution across the AI ecosystem. The July 2 deadline means the structure should be operational within days, though voluntary participation limits enforceability.

Research Spotlight

A Systematic Investigation of RL-Jailbreaking in LLMs

Researchers published findings on reinforcement learning-based jailbreaking techniques that successfully compromised all targeted models and safeguards. Results reveal that the RL-jailbreaker successfully compromised all targeted models and safeguards, and through this first-of-its-kind analysis, demonstrate that environment formalization, specifically dense rewards and extended episode lengths, is the primary driver of jailbreaking success. The research provides systematic analysis of what makes RL-based attacks effective and offers a framework for improving defensive training.

Indirect Prompt Injection: Defenses and the 2026 State of the Art

The International AI Safety Report 2026 found that sophisticated attackers bypass best-defended models approximately 50% of the time with just 10 attempts, and at scale, 1% is not a passing grade for a security control. The comprehensive analysis demonstrates that prompt injection cannot be fully solved within current LLM architectures, as acknowledged by OpenAI, Anthropic, and Google DeepMind in 2025 publications, because the model-level attack surface is effectively unbounded—any defense expressed as a prompt instruction can itself be overridden.

AB Jailbreaking: Novel Hybrid Framework for LLM Exploitation

A three-stage hybrid jailbreak framework combines black-box semantic adversarial prompt variant generation with a compact, regularised embedding-level suffix optimiser that discretises to legal tokens, using an attacker LLM to produce multiple semantically diverse adversarial variants for each harmful behaviour and a judge LLM to score and filter these variants into a high-quality candidate pool. Published in Scientific Reports in April 2026, the research demonstrates that hybrid approaches combining semantic and embedding-level attacks achieve higher success rates than either technique alone.

MultiBreak: Multi-turn Jailbreak Benchmark

Early single-turn jailbreaks poorly capture real-world adversarial behaviors, which typically emerge across multi-turn conversations where users iteratively refine intents, with recent research shifting to multi-turn jailbreaks where attackers either start with innocuous prompts that gradually steer the model toward harmful intent or conceal malicious content across rounds of benign dialogue. The benchmark provides standardized evaluation methodology for multi-turn attack scenarios that better represent production exploitation patterns.

What This Means For You

The threat timeline just accelerated. The Five Eyes assessment moves “AI-enabled attacks that overwhelm existing defenses” from future concern to months-away reality. Security teams cannot wait for perfect defensive solutions—they must implement defense-in-depth now. Priority actions: inventory all AI systems exposed to untrusted input (public APIs, document processors, email summarizers), implement strict input validation and output filtering on every LLM integration, and establish monitoring for abnormal API usage patterns that may indicate automated exploitation.

Supply chain is the primary attack vector. The PyTorch Lightning compromise, vLLM vulnerabilities, and the cluster of CVEs in AI development tooling all target the ML software supply chain. Organizations must implement SBOM tracking for all ML dependencies, pin specific versions rather than accepting latest in production environments, and establish isolated environments for evaluating new ML packages before deployment. Consider every ML package with >1M downloads per month a tier-one supply chain risk.

Prompt injection is not solved and won’t be. Research this week reinforced that prompt injection bypasses even best-defended models 50% of the time with just 10 attempts, and that the vulnerability is architectural—not fixable through better training or filtering. The defensive posture must assume prompt injection will succeed and implement controls that limit blast radius: run LLMs with minimum necessary privileges, never grant LLM-controlled agents access to sensitive data stores without human approval gates, implement strict egress filtering to detect data exfiltration, and log every LLM-initiated action for forensic analysis.

Model access is now a national security control. The Anthropic Mythos 5 ban and the controlled distribution of OpenAI GPT-5.5-Cyber establish a precedent: frontier models with expert-level cyber capabilities will be subject to export controls and restricted distribution. Organizations building AI security programs should prepare for a future where the most capable models are only available through government-approved channels, and where using those models requires demonstrating adequate security controls and operational procedures. The era of unrestricted frontier model access is ending.

Tools and Resources

• PromptArmor — Research implementation achieving <1% false positive/negative rates on AgentDojo prompt injection benchmark (ICLR 2026)
• MITRE ATLAS v4.5.0 — Updated adversarial tactics and techniques for AI systems, now cataloging 80+ AML.T techniques across 14 tactics
• vLLM 0.17.0 — Latest release patches CVE-2026-25960 SSRF bypass and multiple other critical vulnerabilities
• NIST IR 8596 (Preliminary Draft) — Cybersecurity Framework Profile for AI extending CSF 2.0 to AI-specific risks
• OWASP Top 10 for Agentic Applications 2026 — New framework addressing security risks specific to autonomous AI agents