Last Week in AI Security — Week of June 29, 2026

Executive Summary

The week of June 29, 2026, opened with the resolution of the most consequential AI model restriction in history: Fable 5 was suspended for 19 days, from June 12 to July 1, 2026, in the most disruptive government-ordered AI model restriction in history. The U.S. Commerce Department lifted the export controls on Claude Fable 5 on July first after nearly three weeks offline, with Anthropic’s flagship model returning with enhanced security including a new classifier blocking the jailbreak technique that triggered the ban.

The restoration came with unprecedented requirements that signal a fundamental shift in how frontier AI models will be governed. Anthropic agreed to co-development with Amazon, Microsoft, and Google of a shared jailbreak risk scoring framework, creating what amounts to a shared rubric for evaluating AI model security findings where jailbreak disclosures will be accompanied by standardized risk scores rather than leaving each organization to independently assess severity. This framework represents the first industry-wide consensus on vulnerability scoring for AI systems—a milestone comparable to the creation of CVSS for traditional software vulnerabilities.

While U.S. policymakers negotiated Fable 5’s return, China’s cybersecurity industry demonstrated why export controls face mounting challenges. China’s Qihoo 360 unveiled ‘Tulongfeng,’ an AI rivaling Anthropic’s Mythos in hacking, raising national security alarms and escalating the AI arms race between the nations. The timing underscores a strategic reality: API-level access restrictions cannot contain capabilities that adversaries can replicate through open research and indigenous development.

On the vulnerability front, CVE-2026-12957 (CVSS 8.5) sat in how Amazon’s AI coding assistant handled Model Context Protocol (MCP) servers, allowing a malicious repository to run commands and steal a developer’s cloud credentials. The flaw exemplifies the supply chain attack surface that now encompasses AI-powered development tooling, where a single malicious repository can compromise credentials at scale.

Top Stories

Fable 5 Restored After Historic 19-Day Export Control Ban

The US Commerce Department lifted export controls on Claude Fable 5 on July first after nearly three weeks offline, ending the most significant government-ordered AI model restriction to date. The suspension, which began June 12, was triggered when Amazon researchers found a jailbreak that bypassed Fable 5’s safety classifiers and caused the model to identify software vulnerabilities and, in one case, write code demonstrating how to exploit one.

The restoration came with binding requirements that effectively integrate Anthropic into the U.S. government’s AI security infrastructure. According to Build Fast with AI’s detailed timeline, the agreement includes four key elements: participation in the interagency AI cybersecurity vulnerability clearinghouse established under the June 2 executive order, which coordinates vulnerability scanning, discovery, and remediation across critical infrastructure, and co-development with Amazon, Microsoft, and Google of a shared jailbreak risk scoring framework.

This jailbreak scoring framework represents a watershed moment for AI security governance. The four-company jailbreak risk scoring framework aims to create a shared rubric for evaluating AI model security findings, enabling a future state where jailbreak disclosures will be accompanied by standardized risk scores. For security practitioners, this means vulnerability assessments for AI systems will finally have the same structured severity framework that CVE/CVSS provides for traditional software.

The export control episode also established important precedent for rapid government intervention. On June 12, 5:21 PM ET, the US Department of Commerce issued an emergency export control directive citing national security authorities, ordering Anthropic to suspend access to both Fable 5 and Mythos 5 for any foreign national, anywhere, including foreign-national Anthropic employees. Within hours, both models were offline globally—demonstrating that frontier AI models are now treated as dual-use technologies subject to the same emergency restriction mechanisms as weapons systems.

Four-Company Jailbreak Scoring Framework Establishes Industry Standard

The most significant governance development this week was not regulatory but collaborative: The four-company (Anthropic, Amazon, Microsoft, Google) jailbreak risk scoring framework aims to create a shared rubric for evaluating AI model security findings. This framework, developed as part of Fable 5’s restoration agreement, creates the first standardized vulnerability assessment methodology specifically designed for AI systems.

The practical implication for enterprise security teams is substantial. For enterprise security teams, the practical implication is a future state where a jailbreak disclosure about a model in your stack will be accompanied by a standardized risk score rather than leaving each organization to independently assess severity. Currently, when a researcher discloses a prompt injection or jailbreak technique, security teams must conduct their own assessment of exploitability, impact, and remediation priority—often without sufficient context about the technique’s reliability or the vendor’s remediation timeline.

For AI procurement teams, the framework is a signal that frontier labs are moving toward shared security governance infrastructure, which may eventually translate into standardized security disclosure requirements for enterprise AI contracts. This standardization matters because it creates enforceable expectations: vendors will be measured against a common baseline, and procurement decisions can finally incorporate quantitative security posture rather than relying on vendor assurances alone.

China’s Qihoo 360 Unveils Mythos-Rival Tulongfeng AI

As U.S. policymakers negotiated the restoration of Fable 5, China’s Qihoo 360 demonstrated why export controls face fundamental limitations in containing advanced AI capabilities. China’s Qihoo 360 unveiled ‘Tulongfeng,’ an AI rivaling Anthropic’s Mythos in hacking, raising national security alarms and escalating the AI arms race between the nations, according to Forbes reporting on June 30.

The timing is significant: Tulongfeng’s announcement came just days after the U.S. imposed export controls on Fable 5, and while those controls were still in effect. The announcement underscores a strategic reality already evident in previous disclosures: China’s open-weight GLM-5.2 matched Mythos on security benchmarks, and because no export order can reach a self-hosted open-weight model, the containment logic of API-level export controls faces a direct challenge.

For security practitioners, Tulongfeng represents the operationalization of a threat model that intelligence agencies have warned about for months. The Five Eyes joint statement from last week explicitly warned that AI models capable of bypassing cyber defenses were months away; Qihoo 360’s announcement suggests that timeline may have been optimistic. Organizations must now plan for a threat environment where multiple nation-states possess AI capabilities for automated vulnerability discovery and exploit generation.

Critical Amazon Q Developer Vulnerability Enables Credential Theft

A high-severity flaw in Amazon Q Developer, tracked as CVE-2026-12957 (CVSS 8.5), allowed a malicious repository to run commands and steal a developer’s cloud credentials through improper handling of Model Context Protocol (MCP) servers, disclosed by Wiz researchers on June 29. The vulnerability exemplifies the new attack surface created by AI-powered development tooling.

The attack path is elegantly simple and disturbingly effective. A developer opens a malicious repository, trusts the workspace, and Amazon Q does the rest—the path was short, enabling code execution and credential theft. The flaw sits at the intersection of two trust assumptions: developers trust the repositories they clone, and AI coding assistants trust the workspaces they operate in. When those assumptions collide with a malicious actor, the result is supply chain compromise at developer workstation scale.

Amazon has patched the vulnerability, but the disclosure highlights a broader concern for organizations deploying AI-powered development tools. Recent supply chain vulnerabilities in developer tooling such as Amazon Q Developer, combined with the rapid adaptation of evasion tactics against AI-driven security, reinforce the need for updated threat modeling across organizations implementing large language models and related technologies.

Security teams should immediately verify that Amazon Q Developer is updated and review workspace trust policies for AI-enabled development environments. The Model Context Protocol, which enables AI assistants to interact with local development environments, should be treated as a privileged execution boundary requiring the same controls as IDE plugins and language server protocols.

Framework & Standards Updates

NIST AI RMF Critical Infrastructure Profile Concept Note Released

On April 7, 2026, NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure, which will guide critical infrastructure operators towards specific risk management practices to consider when engaging AI-enabled capabilities. While this announcement predates the current reporting week, its implications are being actively discussed in the security community as organizations prepare for the profile’s expected publication.

The profile represents NIST’s recognition that generic AI risk management frameworks require sector-specific translation for operational effectiveness. NIST’s concept note highlights sector-specific risk considerations for energy, healthcare, transportation, and other critical infrastructure sectors, with emphasis on safety, resilience, and system reliability, signaling a broader move toward contextualized AI risk management.

Organizations operating in critical infrastructure sectors should begin preparing now. Organizations are expected to implement controls specific to generative AI, not just general AI governance policies, and the Critical Infrastructure Profile will likely establish baseline expectations for AI security posture in regulated environments.

Cloud Security Alliance Publishes Agentic AI Profile for NIST Framework

The Cloud Security Alliance released a practitioner-oriented Agentic AI Profile complement to the NIST AI RMF, addressing the governance gap for autonomous AI agents. NIST has indicated that an AI Agent Interoperability Profile is planned for release in the fourth quarter of 2026, and the CSA document is intended to serve as interim guidance.

The profile identifies four structural gaps in the base AI RMF when applied to agentic systems: An agentic system can fail by initiating a cascade of irreversible actions before any human observes incorrect behavior, creating a temporal gap between initiation and observation as a fundamental new risk dimension, and the structural property of delegation means accountability becomes distributed when an orchestrating agent spawns sub-agents.

Security teams implementing agentic AI systems should review the CSA profile alongside OWASP’s newly released Top 10 for Agentic Applications. The OWASP Top 10 for Agentic Applications 2026 is the new benchmark for security in this autonomous age and is not a suggestion but a framework for survival.

Vulnerability Watch

CVE-2026-12957: Amazon Q Developer MCP Configuration RCE (CVSS 8.5)

Affected versions: Amazon Q Developer versions prior to June 29, 2026 patch
Impact: The bug in Amazon Q Developer’s handling of Model Context Protocol (MCP) servers allowed malicious repositories to run commands and steal cloud credentials when developers opened and trusted a workspace
Mitigation: Amazon has released a patch. Update Amazon Q Developer immediately and review workspace trust configurations.

CVE-2026-22778: vLLM Video Processing RCE (CVSS 9.8)

Although disclosed February 2, 2026 (outside our reporting window), this vulnerability continues to receive attention as organizations assess their vLLM deployments. CVE-2026-22778 allows an attacker to achieve Remote Code Execution simply by sending a malicious video link to a vLLM API, enabling server takeover via video URL submission.

The vulnerability chains two flaws: vLLM handles errors from PIL that expose heap addresses in error messages, and this leaked address reduces ASLR effectiveness from approximately 4 billion possible combinations down to around 8 guesses. The second component exploits a JPEG2000 decoder bundled with OpenCV’s FFmpeg dependency, where decoding JPEG2000-encoded video frames honors a channel definition box allowing channel remapping.

Affected versions: vLLM versions prior to 0.14.1
Mitigation: Update vLLM to version 0.14.1 or later, which includes fixes for both the information leak and heap overflow

PyTorch Lightning Supply Chain Compromise (Versions 2.6.2, 2.6.3)

On April 30, 2026, PyPI-distributed versions of pytorch-lightning 2.6.2 and 2.6.3 were compromised in a supply chain attack targeting the distribution layer, not the source code repository. The community response was remarkably swift: The attack affected those who installed PyTorch Lightning via PyPI between 12:45:20 and 13:27:30 UTC on April 30th, 2026—a 42-minute window.

Impact: The malicious package includes a hidden _runtime directory containing a downloader and an obfuscated JavaScript payload
Mitigation: Organizations that installed PyTorch Lightning between 12:45 and 13:28 UTC on April 30 should assume credential compromise and rotate all secrets accessible from affected environments. Review the official security advisory GHSA-w37p-236h-pfx3 for indicators of compromise.

CVE-2026-24747: PyTorch weights_only Unpickler RCE (CVSS 8.8)

CVE-2026-24747 is a remote code execution vulnerability in PyTorch’s weights_only unpickler that allows attackers to craft malicious checkpoint files capable of corrupting memory and potentially achieving arbitrary code execution when a victim loads a checkpoint file using torch.load(…, weights_only=True).

The vulnerability is particularly concerning because it undermines a security boundary explicitly designed to prevent untrusted code execution. The weights_only mode was introduced as a security feature to mitigate the well-known risks of Python’s pickle module, which can execute arbitrary code during deserialization, but a flaw in the implementation allows attackers to craft checkpoint files that bypass these restrictions.

Affected versions: PyTorch versions with weights_only unpickler prior to January 27, 2026 patch
Impact: Arbitrary code execution via malicious model checkpoint files
Mitigation: Update PyTorch to the latest version and implement additional validation for model checkpoints from untrusted sources.

Industry Radar

• Dawnguard raises $6.4M for Mythos-era AI security platform: Dawnguard has raised $6.4 million of investment and opened a New York office as it seeks to commercialize its cyber security platform designed for the ‘Mythos Era’ of AI-powered threats

• Singapore releases comprehensive AI threat landscape report: Singapore’s Cyber Security Agency (CSA) released the Singapore Cyber Landscape 2025/2026 report, warning that AI is enabling faster and more sophisticated cyberattacks, with agentic AI capable of automating parts of the cyber kill chain and accelerating vulnerability research and exploit development

• AI for Good Global Summit convenes July 7 in Geneva: The AI for Good Global Summit 2026 starts Tuesday, July 7, in Geneva, focusing on exploring and advancing practical AI applications to address global challenges and support the SDGs through keynote speeches, panels, exhibitions, and workshops

Policy Corner

White House AI Security Framework Update Due August 1

The voluntary AI model standards framework referenced in Fable 5 restoration negotiations has a hard deadline approaching. The framework Anthropic agreed to will be the model that other frontier labs are asked to adopt under the August 1 voluntary standards announcement. This August 1 deadline stems from the June 2 Executive Order’s 60-day requirement for completing the covered frontier model framework.

Organizations providing AI models to government customers or operating in critical infrastructure sectors should prepare for these voluntary standards to become de facto requirements for procurement and compliance purposes. While technically voluntary at the federal level, sector regulators including the FTC, CFPB, FDA, SEC, and EEOC cite framework principles when evaluating AI practices, and the Treasury Department’s Financial Services AI RMF, released February 2026, translates NIST principles into 230 control objectives specifically for financial institutions.

EU AI Act High-Risk System Obligations Enter Phased Enforcement

High-risk AI system obligations begin phased enforcement into 2026, with NIST RMF widely used as a technical companion framework for AI Act compliance. Organizations operating AI systems classified as high-risk under the EU AI Act should ensure their governance frameworks map to both the Act’s requirements and the NIST AI RMF, as multinational companies are adopting NIST as the ‘operational layer’ beneath regulatory compliance.

Research Spotlight

Prompt Injection and Jailbreak Attack Landscape Evolution

Several academic analyses published this week document the evolving sophistication of prompt injection and jailbreak techniques. A comprehensive analysis in the ACM LLM-SHIELD workshop notes that adversarial threats against LLMs present urgent challenges to their safety and reliability, with prompt injection attacks where an attacker injects a prompt into the original one aiming to make an LLM follow the injected prompt to perform an attacker-chosen task representing a critical security threat.

The research confirms what security practitioners have observed in production: Indirect prompt injection has been ranked by OWASP and NIST among the top risks for 2025–2026, and while frontier models (GPT series, Claude, Gemini 2.x, o-series) have significantly strengthened defenses through instruction hierarchy, RLHF, and alignment training, multi-turn, structured, indirect, and automated attacks remain extremely high-threat—especially in Agentic AI systems with tools, memory, and action capabilities.

A particularly detailed defensive knowledge base compiled in June 2026 catalogs known attack patterns with version-specific effectiveness data. The analysis emphasizes that attack success rate figures are version- and date-pinned because vendors patch continuously, and published ASRs are systematically overstated, with lenient evaluators inflating scores and jailbreaks that bypass safety tuning frequently degrading model capability.

Adversarial Machine Learning: Training-Time vs. Inference-Time Attacks

A comprehensive survey published in Neurocomputing provides updated taxonomy for adversarial ML threats. The survey presents a systematic taxonomy of adversarial threats spanning the ML lifecycle, including training-time attacks such as data poisoning and backdoor insertion, as well as inference-time attacks such as evasion, model extraction, and privacy leakage.

The distinction between attack surfaces matters for defense prioritization. Training-time attacks require compromise of the data pipeline or training infrastructure, while inference-time attacks can be executed by any user with API access. Organizations must secure both, but the controls differ fundamentally: training-time security focuses on supply chain integrity and data provenance, while inference-time security requires input validation, output monitoring, and rate limiting.

CVE-Genie: Automated Framework for Reproducing Vulnerabilities

Researchers have developed CVE-Genie, an automated LLM-based framework for reproducing real-world vulnerabilities from CVE entries. CVE-Genie is an automated, large language model-based multi-agent framework designed to reproduce real-world vulnerabilities provided in CVE format to enable creation of high-quality vulnerability datasets by gathering relevant resources, automatically reconstructing vulnerable environments, and producing verifiable exploits.

This research is relevant to AI security in two ways: it demonstrates the offensive capability of AI-assisted exploit development, and it addresses the data quality problem that hampers ML-based vulnerability detection. High-quality datasets with detailed examples and ground truth are key requirements for effective automated vulnerability detection, and low-quality data can cause ML-based techniques to learn spurious correlations.

What This Means For You

Prepare for standardized jailbreak risk scoring. The four-company framework emerging from Fable 5’s restoration will become the industry standard for assessing prompt injection and jailbreak severity. Security teams should begin mapping their existing AI risk assessment processes to this framework now, even before formal publication. When the framework releases (likely in Q3 2026), you’ll need to incorporate it into vendor security questionnaires, procurement requirements, and incident response playbooks.

Update AI-powered development tooling immediately. CVE-2026-12957 in Amazon Q Developer is the first of what will be many vulnerabilities in AI-enhanced IDEs and coding assistants. These tools operate with developer-level privileges and access to credentials, making them tier-one supply chain targets. If you’ve deployed Amazon Q, GitHub Copilot, or similar AI coding assistants, verify patch status this week and implement workspace trust policies that treat AI assistant permissions as equivalent to IDE plugin execution.

Reevaluate export control assumptions for AI capabilities. China’s Tulongfeng announcement and the GLM-5.2 open-weight model matching Mythos on security benchmarks demonstrate that API-level access restrictions cannot contain advanced AI capabilities. Organizations should threat model based on the assumption that adversaries have access to Mythos-class vulnerability discovery capabilities, not based on the assumption that export controls will constrain diffusion. This means accelerating patch cycles, prioritizing detection over prevention, and investing in resilience rather than relying solely on perimeter defense.

Audit your AI supply chain for April 30 exposure. The PyTorch Lightning compromise window was only 42 minutes, but those 42 minutes may have affected your organization if you run automated dependency updates or CI/CD pipelines that pulled packages during that window. Check whether any systems installed pytorch-lightning==2.6.2 or ==2.6.3 between 12:45:20 and 13:27:30 UTC on April 30, 2026. If so, assume credential compromise and rotate secrets accessible from affected environments.

Implement agentic AI governance before deploying agents. If your organization is evaluating or deploying agentic AI systems (AI that takes autonomous actions, not just generates text), review the Cloud Security Alliance’s Agentic AI Profile and OWASP’s Top 10 for Agentic Applications before production deployment. The risk profile for agents differs fundamentally from static models: agents can initiate cascading actions before humans detect errors, making traditional human-in-the-loop controls insufficient. You need circuit breakers, action logging, and delegation boundaries—not just content filtering.

Tools and Resources

• OWASP Top 10 for Agentic Applications 2026 — Critical security framework for autonomous AI agents. Unlike the LLM Top 10, this addresses multi-step action chains, tool access, and delegation risks specific to agents that act rather than just respond.

• Cloud Security Alliance Agentic AI Profile — Practitioner-oriented NIST AI RMF extension for agentic systems. Bridges the gap until NIST’s official AI Agent Interoperability Profile arrives in Q4 2026.

• NIST AI RMF Critical Infrastructure Profile Concept Note — Preview of sector-specific guidance for energy, healthcare, transportation, and other critical infrastructure operators deploying AI. Full profile expected later in 2026.

• DeepTeam LLM Red Teaming Framework — Open-source toolkit for testing AI systems against OWASP Top 10 for LLMs, MITRE ATLAS, and other frameworks. Includes automated risk assessment across multiple threat categories.

• Prompt Injection Knowledge Base (June 2026) — Comprehensive catalog of prompt injection and jailbreak techniques with version-specific effectiveness data, compiled from primary literature and vendor disclosures. Defensive/educational focus with defanged examples.