More than a third of AI companies have critical, unpatched vulnerabilities in their internet-facing systems, according to a new Black Kite study. The findings expose security weaknesses among vendors whose models, applications, and integrations increasingly connect to sensitive enterprise data.
Black Kite's Nov. 10 report assessed 18,160 AI companies worldwide and identified critical vulnerabilities at 34.2% of them. Another 9.8% had at least one vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, which tracks flaws exploited in real-world attacks.
The research also uncovered weaknesses in email authentication, exposed credentials, and shared AI infrastructure. For organizations relying on third-party AI services, those findings introduce additional considerations when evaluating vendors and controlling access to business systems.
Black Kite finds widespread AI supplier security gaps
The 2026 AI Supply Chain Report examined externally observable security conditions across companies developing, deploying, and supporting AI products.
The findings reveal several areas of concern:
| Security finding | AI companies affected |
|---|---|
| Critical unpatched vulnerabilities | 34.2% |
| CISA KEV-listed vulnerabilities | 9.8% |
| At or above critical ransomware susceptibility threshold | 29.7% |
| Unusual network activity | 44.3% |
| DMARC email authentication weaknesses | 61.7% |
| Corporate credentials found in infostealer records | 6.8% |
Researchers identified critical vulnerabilities by matching internet-facing software and device versions against publicly disclosed critical-severity CVEs.
Black Kite's proprietary Ransomware Susceptibility Index placed 29.7% of the companies at or above its critical-risk threshold, while unusual network activity appeared across 44.3% of the assessed suppliers.
Larger AI companies showed greater exposure. Among suppliers with more than 50 employees, 58% had critical unpatched vulnerabilities, compared with 34.2% across the full sample.
A separate assessment of the Forbes AI 50 found critical unpatched vulnerabilities at 52% of those companies.
Larger organizations typically operate more internet-facing systems, expanding the number of potential entry points and the infrastructure security teams must maintain.
Shared AI tools create additional exposure
Black Kite identified 105 companies with vulnerability findings associated with three widely used AI tools:
- n8n: 93 companies had exposure to CVE-2025-68613, a remote code execution vulnerability listed in CISA's KEV catalog.
- Langflow: Five companies had related findings, including four associated with two KEV-listed vulnerabilities.
- LiteLLM: Seven companies had findings involving the AI model gateway.
These tools help connect AI applications to databases, external services, and automated workflows. Vulnerabilities in those connections can expose credentials or provide attackers with opportunities to execute unauthorized commands.
Previous attacks against LiteLLM and MCP servers have demonstrated the security risks associated with compromised AI infrastructure.
Black Kite also examined publicly discoverable Model Context Protocol (MCP) components, identifying 1,732 security findings. Nearly half, 48.8%, were rated high or critical.
Of the 77 critical MCP findings, 87% involved code or command injection, creating potential paths for attackers to interfere with connected systems.
The concentration of these vulnerabilities in shared infrastructure creates additional challenges for enterprises that depend on multiple AI services built on common components.
How security teams should assess AI suppliers
The findings add urgency to third-party security assessments as businesses expand their use of AI services and grant automated systems access to internal applications.
Security teams can reduce exposure by incorporating AI-specific dependencies and permissions into existing vendor risk management processes.
Key actions include:
- Prioritize exploited vulnerabilities. Check suppliers against CISA's KEV catalog, request remediation timelines, and verify that critical fixes have been applied. Recent CISA additions affecting AI infrastructure reinforce the need to address actively exploited flaws.
- Investigate credential exposure. Require suppliers to revoke compromised credentials, terminate affected sessions, and investigate unauthorized access.
- Map software dependencies. Identify the AI gateways, workflow tools, open-source libraries, and external models that vendors rely on.
- Restrict integrations. Limit AI applications to the permissions and business systems they require, and establish procedures for revoking access when necessary.
- Monitor vendor security continuously. Track newly disclosed vulnerabilities, infrastructure changes, and missed remediation deadlines after onboarding.
These measures complement broader efforts to address AI software supply-chain risks involving third-party packages, developer tools, and connected services.
Visibility gaps complicate vendor assessments
Black Kite gathered its findings during September and October 2026 using external scanning and threat intelligence.
The assessment covered companies involved in AI business applications, implementation services, specialized platforms, consumer products, foundational technology, and industrial systems.
The company's external assessment methodology identifies publicly observable vulnerabilities and security signals. Internal security controls, private infrastructure, and remediation practices can require additional investigation.
Smaller companies also tend to have less visible infrastructure, potentially limiting the number of vulnerabilities that external assessments detect.
For enterprises purchasing AI services, supplier evaluations increasingly need to account for both the vendor's security posture and the systems its products can access.
An unpatched flaw in a widely used AI component can affect multiple suppliers, while excessive permissions can extend the consequences of a compromised integration.
Regular vulnerability assessments, dependency inventories, and access reviews can help organizations identify those weaknesses before they spread across connected environments.
Also read: CISA's latest warning about exploited GPUStack and other enterprise vulnerabilities details urgent patching priorities for exposed systems.