The Underwriting File for High-Risk AI

On June 3, 2026, Splunk published SVD-2026-0603 describing CVE-2026-20253 — an unauthenticated arbitrary file creation flaw via a PostgreSQL sidecar endpoint — with limited exploitation observed and fixed versions in 10.4.0 / 10.2.4 / 10.0.7.¹ On the same registry-ecosystem track that produced the June npm worm wave, JetBrains disclosed on June 18 that fifteen malicious Marketplace plugins were exfiltrating AI provider API keys to a hardcoded C2 IP after installing a JVM-wide X509TrustManager to weaken TLS — a credential-theft campaign targeting precisely the developer-tooling surface where AI tokens get pasted into IDE settings.² Microsoft 365 Copilot absorbed CVE-2026-42824 — a one-click prompt-injection “SearchLeak” that exfiltrates data through the assistant’s own search pipeline — while a use-after-free in Chrome’s DigitalCredentials surface (CVE-2026-12451) entered NVD as a sandbox-escape chain component for the post-renderer phase.³⁴ The AIRekt incident catalog refreshed June 21 and now records 484 documented AI security incidents across the Feb–Jun 2026 window — up from 339 last week — against an engineering-checklist taxonomy that pins dependencies to SHAs and gates destructive actions on human approval.⁵ Each of these is a line item. Together they describe the document that is now landing on the treaty-market intake desk and the conformity-auditor’s evidence list at the same time: the underwriting file for high-risk AI.

Issue #13 established the SBOM question for AI stacks as the dependency-graph evidence the treaty market and the regulator both want. This issue widens the lens. The SBOM is one artifact inside a larger document — the underwriting file — that an in-scope deployer is increasingly being asked to assemble before the next renewal cycle and before the EU AI Act’s newly-restated applicability dates land on the calendar. The European Commission’s standardisation page now reiterates the “presumption of conformity” route via harmonised standards, with the Digital Omnibus framing pushing applicability to December 2, 2027 for Annex III high-risk systems and August 2, 2028 for Annex I harmonisation-legislation systems.⁶ The clock has not stopped — it has been re-pegged. The deployer who reads that shift as time gained will spend it building the wrong artifact. The deployer who reads it as time granted to assemble a defensible underwriting file is reading it correctly.

This edition examines the underwriting file as the structural document the treaty market and the conformity auditor are converging on, the JetBrains incident as the credential-boundary case study that re-prices the developer-tooling line item, the M365 Copilot SearchLeak as the prompt-injection one-click exfiltration class the file must now address, the Splunk and Chrome advisories as the operational-vulnerability evidence the file needs as supporting documentation, the EU AI Act applicability shift as the regulatory clock that has been re-pegged rather than relieved, the W25 Market Index reading under the v3.1 methodology released this week, and the five operational moves a high-risk deployer should be making before the file becomes a renewal precondition.

What an Underwriting File for High-Risk AI Actually Contains

The JetBrains Incident as the Credential-Boundary Case Study

On June 18, 2026, JetBrains disclosed that fifteen malicious third-party Marketplace plugins were exfiltrating AI provider API keys after weakening JVM-wide TLS by installing a custom X509TrustManager and exfiltrating credentials over unencrypted HTTP to a hardcoded C2 IP at 39.107.60.51.² JetBrains removed the plugins, banned the publishers, and used the platform’s remote-disable mechanism to neutralize installations in place. The post-incident control changes are the substantively new evidence: JetBrains’ Marketplace ingestion rules now flag raw IP endpoints, non-HTTPS endpoints, and TLS-weakening patterns including custom X509TrustManager implementations — a defensive posture shift that operationalizes the lesson at the platform layer.

The immediate remediation guidance applies directly. Any AI provider keys entered into impacted plugins should be revoked and rotated; provider dashboards should be reviewed for anomalous spend across the relevant window; outbound traffic to the 39.107.60.51 C2 should be blocked at the firewall and DNS layers.² The deeper response is the policy shift: workstation plugin ingestion is now an AI-credential-boundary decision, not an individual-developer-productivity choice. The underwriting file’s credential-boundary section now needs to name an ingestion policy by reference.

The structural significance of the campaign is that the attacker read the AI-credential surface accurately ahead of the defender. Traditional credential-theft taxonomies focus on browser session cookies, OS keychains, and secret-store APIs. The JetBrains attackers correctly identified that the developer workstation has become the primary handling location for the highest-value tokens in the AI stack — the provider keys that authorize unmetered inference spend — and built the campaign against that surface. The underwriting question that follows is whether the deployer’s policy reflects the same accurate map.

The Prompt-Injection One-Click Exfiltration Class Enters the CVE Pipeline

CVE-2026-42824, indexed against Microsoft 365 Copilot under the “SearchLeak” designation, describes a one-click prompt-injection exfiltration through the assistant’s own search pipeline: a crafted document or search query manipulates the assistant into emitting a payload that exfiltrates context across the trust boundary.³ The CVE pipeline absorbing a prompt-injection exfiltration vector under a CVE number is the structurally interesting moment. CVE numbering historically tracks vulnerabilities expressible against a deterministic-software substrate. SearchLeak is the explicit acknowledgement that prompt-injection-class attacks against AI assistants are now treated as the same kind of evidence the rest of the underwriting file is built on.

A parallel sandbox-escape entry — CVE-2026-12451, a use-after-free in Chrome’s DigitalCredentials — landed in NVD with a Chromium “High” severity and a post-renderer sandbox-escape role.⁴ The pairing is significant for the underwriting file because the two vulnerabilities sit at adjacent points in the same attack graph: SearchLeak exfiltrates context from the assistant, and a renderer-side sandbox-escape chain harvests context from the browser. A deployer whose intake-form answer to “how is AI-mediated data exposure mitigated” references only the assistant layer is producing an incomplete file. The same line item now needs to address the browser-substrate layer the assistant runs inside.

The AIRekt catalog crossed 484 incidents this week — up from 339 a week ago, with the refresh tied to a control-checklist update emphasizing dependency pinning to SHAs and human-approval gating for destructive actions.⁵ Read against the underwriting file, the catalog is doing two structural jobs: it is the public baseline an in-scope deployer’s incident-history posture can be aligned against, and the control checklist published alongside it is converging on the kind of operational-control evidence the file’s last line item is going to need.

Operational Vulnerabilities Are the Supporting Documentation

Splunk’s SVD-2026-0603 for CVE-2026-20253 describes an unauthenticated arbitrary file creation/truncation flaw via a PostgreSQL sidecar service endpoint, fixed in 10.4.0 / 10.2.4 / 10.0.7, with PSIRT noting limited exploitation observed in June 2026 and an operational workaround ([postgres] disabled = true) for deployers who cannot upgrade immediately.¹ The advisory is doing the work the underwriting file needs from the operational-vulnerability line item: a first-party disclosure with documented limited exploitation, a fix path with explicit version targets, and an operational mitigation that does not require the upgrade window. A deployer who can answer the intake question “how do you handle KEV-relevant first-party advisories from your security-tooling stack” by reference to this advisory’s handling is producing the right kind of evidence.

Two additional CERT-feed entries name the surface explicitly. CVE-2026-54420 (LiteSpeed cPanel plugin symlink-to-root) and CVE-2026-20262 (Cisco Catalyst SD-WAN Manager escalation) appear in active-exploitation feeds this week, with both carrying the kind of escalation profile that maps onto an underwriter’s “perimeter-exposure” line item.³ A national CERT advisory feed that surfaces Microsoft 365 Copilot SearchLeak alongside LiteSpeed cPanel and Cisco SD-WAN is the working artifact of a convergence the underwriting file already assumes: AI-specific CVEs and classical-perimeter CVEs are now read together because the underwriter and the regulator are both asking for both.

The structural lesson from this section is the supporting-documentation principle. The underwriting file does not need to demonstrate that the deployer has zero vulnerabilities. It needs to demonstrate that the deployer’s vulnerability-management process produces evidence at the same cadence and granularity as the upstream advisories. A Splunk advisory like SVD-2026-0603 is, in this framing, a positive example of what the deployer’s own response artifacts should look like — first-party, version-targeted, workaround-bearing, and timestamped against the disclosure date.

The Regulatory Clock Has Been Re-Pegged, Not Relieved

The European Commission’s AI Act standardisation page now reiterates the “presumption of conformity” route via harmonised standards, with the Digital Omnibus framing linking applicability dates to the availability of support tools and standards.⁶ The latest stated applicability dates: December 2, 2027 for Annex III high-risk AI systems, and August 2, 2028 for Annex I harmonisation-legislation AI systems. The August 2, 2026 date that anchored the conformity narrative in Issues #11–#13 has been re-pegged. The conformity work is not relieved; it is now sequenced against a longer runway with a higher expected evidentiary bar at the new date.

The structural interpretation: the regulator has acknowledged the substrate is not yet ready, but the substrate the regulator is waiting on is precisely the harmonised-standards-and-support-tools layer that will determine what evidence the conformity narrative carries. A deployer who reads the new applicability dates as time to defer the conformity work is misreading the signal. The deployer who reads the new dates as the period during which the harmonised standards will be finalised — and uses the runway to align the conformity narrative against the emerging standards rather than against the deployer’s ad-hoc interpretation — is reading the signal correctly. The presumption of conformity is the dispositive shortcut for the deployer who is positioned to claim it. The presumption is also the dispositive trap for the deployer who positions against the wrong standard.

The underwriting file maps onto the regulatory clock the same way. Eighteen months to Annex III applicability is the assembly window for the conformity-narrative line item, and the early-cycle treaty placements between now and Q1 2027 are the assembly window for the rest of the file. The deployer who waits for the regulator to publish the harmonised standard before starting on the conformity narrative will produce both artifacts under deadline. The deployer who starts on the underwriting file now produces the regulator’s artifact as a derivative of the broader portfolio.

Market Index — W25 Reading and the v3.1 Methodology Release

The ASI Market Index reads 37.9 for Week 25, up +0.2 from W24’s 37.7. The +0.2 is the first composite-level motion since Week 18, and the first reading published under v3.1, the recency-weighted scoring revision the ASI Intelligence Team shipped this week. Under v3.0, the W25 composite would have returned 37.7 for the seventh consecutive week — not because the underlying environment was quiet, but because the aggregation step was averaging in-week motion against a cumulative-substrate baseline of more than two hundred historical records. v3.1 corrects that.

The public-signal readings for W25 under v3.1: VSS 55.1, TSS 49.8, AIRS 38.9. The threat surface absorbed the largest single-week motion of the year — twenty new incidents entered the database between W24 close and the W25 calculation, with a mean composite severity of 71.0 and twelve classified Critical (composite ≥ 70). The full index page carries the W25 audit.

The v3.1 methodology release. The signal-aggregation step has been moved from a cumulative-substrate mean to an eight-week exponentially-weighted moving average with a bounded incidence adjustment. The intent is to preserve the actuarial properties of the scoring while letting in-week event clusters register at the composite level rather than being absorbed into the long-run mean. The W25 reading is the first to ship against v3.1. A publication that scores risk to a treaty market does not change the substrate beneath the scoring without an audit trail; the methodology transition is recorded in market-index-data.json with v3_1_start: 25, and the v3.0 series remains in the weekly history for back-testing.

The Bottom Line — Five Moves Before the File Becomes a Renewal Precondition