Summary
- Black Kite's assessment of 18,160 AI companies found critical unpatched vulnerabilities at 34.2%.
- The research identified exposed credentials, unusual network activity, and vulnerabilities affecting widely used AI integration technologies.
- Supplier security assessments need to address software dependencies and permissions granted to connected business systems.
More than a third of AI companies assessed in a large-scale cybersecurity study have critical unpatched vulnerabilities visible from the internet, raising concerns about suppliers increasingly connected to enterprise applications and sensitive information.
Cyber risk intelligence company Black Kite examined the external security posture of 18,160 AI companies worldwide for its 2026 AI Supply Chain Report, published on 10 November.
The research found critical unpatched vulnerabilities at 34.2% of assessed businesses. A smaller group, 9.8%, had at least one vulnerability listed in CISA’s Known Exploited Vulnerabilities catalogue.
Almost 30% reached Black Kite’s critical ransomware susceptibility threshold, while 44.3% showed unusual network activity compared with their historical baselines.
These are external measurements of potential exposure, not confirmed successful attacks. A vulnerability’s presence in a catalogue of previously exploited flaws does not establish exploitation against every company running affected software.
AI procurement brings connected dependencies
Businesses increasingly obtain AI capabilities from external suppliers that provide models, software applications, workflow automation, and implementation services.
Such arrangements may involve access to company documents, software repositories, cloud applications, and operational systems, extending the supplier relationship beyond conventional information processing.
Black Kite assessed three connected areas: the supplier’s own security posture, the components underlying its products, and the permissions granted to integrations reaching customer systems.
An organisation can maintain strong internal controls while remaining dependent on a provider whose infrastructure is exposed or whose software contains vulnerable components.
Security reviews therefore need to consider not only the apparent maturity of a product but also how its supplier maintains access, patches infrastructure, and manages dependencies.
Larger suppliers show more visible findings
The study found that companies with more than 50 employees were more likely to have externally observable security findings.
Fifty-eight per cent of those larger AI businesses had at least one critical unpatched vulnerability, compared with 34.2% across the full sample.
Employee credentials appeared in infostealer records for 29% of the larger businesses, against 6.8% across the overall population.
Companies that had raised more than $250 million showed a critical-vulnerability rate of 69%.
Size complicates interpretation because larger businesses generally expose more systems to external observation, creating more opportunities to identify vulnerabilities.
Conversely, approximately one-third of the companies in the study had ten or fewer externally visible assets. An absence of findings at a small supplier cannot be treated as proof of comprehensive internal protection.
Shared components create overlapping risk
Black Kite identified 105 AI companies with findings associated with n8n, Langflow, or LiteLLM, technologies commonly used to connect AI applications, model services, and automated workflows.
Ninety-three companies had exposure linked to the n8n vulnerability CVE-2025-68613, while five had Langflow-related findings and seven had LiteLLM-related findings.
These dependencies can concentrate risk because otherwise unrelated suppliers may rely on the same software component for orchestration, credentials, or access to other applications.
Multiple contracts may therefore create the same underlying technical dependency rather than providing genuine diversification of exposure.
MCP infrastructure adds another access boundary
The report also assessed publicly discoverable Model Context Protocol (MCP) components, which can connect AI applications to databases and external business systems.
That separate dataset contained 1,732 security findings across 305 server entries attributed to 179 AI companies. Of those findings, 48.8% were rated high or critical.
Among 77 critical findings, 87% concerned code or command injection.
Those figures describe the assessed MCP component findings, not the proportion of all AI suppliers running vulnerable MCP infrastructure. Private deployments not visible to Black Kite’s methods are outside that part of the study.
Organisations should understand which services each AI integration can access, whether the granted permissions exceed operational needs, and whether access can be revoked promptly when a supplier is compromised.
External monitoring complements supplier assurance
Black Kite also identified missing or misconfigured DMARC email authentication policies at 61.7% of the assessed companies, illustrating gaps in established security controls alongside newer AI-specific dependencies.
External assessments can identify changes in visible infrastructure over time, but they may miss internal controls and privately deployed services. Direct supplier questions, contractual requirements, and technical reviews remain necessary.
The full 2026 AI Supply Chain Report sets out the methodology and findings, using observations from September and October.
The study shows that rapid development of AI capabilities does not necessarily coincide with consistent security maturity among the businesses supplying them, while the resulting exposure can extend through shared software and enterprise integrations.
