The biclique attacks that break AES (Biclique Cryptanalysis of the full AES) appear to require decryption oracles to work, presumably because the key schedule of AES is weaker in the decryption direction, enabling better bicliques to be constructed starting from the ciphertext end. Which is to say, these attacks show that AES does not have 128 bits of security under the Chosen Ciphertext Attack (CCA) model.
But what about modes of operation that only require us to assume the underlying block cipher is a PRP rather than a SPRP, i.e. secure under the Chosen Plaintext Attack (CPA) model? For example, CTR mode. Does AES-128-CTR mode still have 128 bits of security not-withstanding the biclique attacks? Are there also biclique attacks on the full AES starting from the plaintext end?