The AMP settings screen code in AMP_Options_Manager has a few instances of unescaped output:

• The translated strings in the warning messages that contain links are unescaped. They should be passed through wp_kses( $translation, [ 'a' => [ 'href' => true ] ] ).
• The settings errors are stored without sanitization in the database and are then displayed without escaping in the admin backend. They should be passed through esc_html() before storing them in the database.