I kind of remember running into something similar while working on some project. This is what I had done at that time:
<dependency>
<groupId>org.jboss.jbossas</groupId>
<artifactId>jboss-as-client</artifactId>
<version>6.0.0-SNAPSHOT</version>
<scope>runtime</scope>
<type>pom</type>
<exclusions>
<exclusion>
<groupId>org.jboss.security</groupId>
<artifactId>jbosssx-client</artifactId>
</exclusion>
<exclusion>
<groupId>org.jboss.security</groupId>
<artifactId>jbosssx</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.picketbox</groupId>
<artifactId>jbosssx-client</artifactId>
<version>3.0.0.CR2</version>
<scope>runtime</scope>
</dependency>
Note that I have excluded the jbosssx-client and jbosssx from being pulled in from jboss-as-client and instead added an explicit dependency on picketbox. (replace the SNAPSHOT reference with the appropriate Final version and also check what version of picketbox is shipped in 6.0 Final). At that time I did not have the time to dig into this deeper.