34.2% of AI Suppliers Have Critical Unpatched Flaws, Black Kite Finds

Black Kite's external assessment of 18,160 AI companies found critical unpatched vulnerabilities at 34.2% of them, according to its 2026 AI Supply Chain Report: The Risks Behind Your AI Relationships. Email-authentication weaknesses showed up at an even larger share. The report's core message is blunt: the companies selling advanced AI often carry the same ordinary cybersecurity problems as everyone else.

The report's central argument is that buying AI creates more than a software relationship. Customers inherit exposure to the supplier's infrastructure, the components behind its product, and the permissions its integrations receive. As AI tools gain the ability to act inside business systems, those relationships deserve the same scrutiny as any other critical supplier.

Ferhat Dikbiyik, Black Kite's chief research and intelligence officer, put it plainly: "The AI supply chain isn't failing in exotic ways. It's failing in ordinary ones." The findings put patching, credential protection, and integration access at the center of the discussion.

What did the study measure?

Black Kite built its study population from a commercial company database, then reviewed business descriptions and public websites to confirm that AI was central to each company's products or services. All company-level security observations draw on September and October 2026 data.

The headline numbers:

• 34.2% had at least one externally observed critical unpatched vulnerability.
• 9.8% had a vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
• 61.7% had DMARC weaknesses, while DKIM and SPF weaknesses appeared at 37.3% and 11.2%, respectively.
• 29.7% reached or exceeded 0.4 on Black Kite's Ransomware Susceptibility Index, the company's critical threshold.
• 6.8% had associated corporate login information in records collected by information-stealing malware.

Each measure answers a different question, and the report is careful about what the numbers do and don't say. A KEV-listed flaw has a documented history of exploitation somewhere in the world; its presence doesn't establish that the supplier in this study was attacked. Likewise, a ransomware-susceptibility score is an indicator for prioritizing review, not the probability that a particular company will suffer ransomware.

The takeaway is simple: these are risk signals, not breach confirmations.

Why does email authentication matter for AI vendors?

Email authentication is relevant because AI suppliers still operate ordinary corporate domains and business processes. Missing or weak enforcement can make domain impersonation easier even when the AI product itself is technically sophisticated. The DMARC, DKIM, and SPF figures overlap and should not be added together.

That an AI vendor runs a clever model says nothing about whether its domain can be spoofed. The boring parts of corporate security still apply, and in most of this population they're not in good shape.

Do supplier roles matter more than AI branding?

The report divides the ecosystem into six broad activity groups. Foundational technologies — including models, computing infrastructure, and data services — account for about 10% of the population. Everyday business applications represent about 31%, while companies developing and implementing AI for other organizations account for roughly 23%.

That breakdown helps explain why focusing only on well-known model providers misses a substantial part of enterprise exposure. Integrators, cloud-service providers, data handlers, and customer-service platforms can operate close to customers' systems and information.

Credential findings were especially pronounced in those roles. Black Kite found associated corporate logins in infostealer records at 19.9% of cloud AI solution providers, compared with 4.1% of model and platform developers. Data and labeling companies stood at 13.9%, and customer-service platforms at 11.5%.

The concern is what those credentials could unlock if still valid, not an assumption that every exposed login has been used. Supplier reviews need to connect the finding to the service being purchased: a credential for an unrelated business tool and one with access to a customer-facing production environment can have very different consequences.

The closer a supplier sits to customer systems, the more its credential hygiene becomes the customer's problem.

What about the suppliers' own dependencies?

The report's second layer examines the software components underneath AI products. Black Kite identified 105 AI companies with findings associated with n8n, Langflow, or LiteLLM — tools that can sit between models, workflows, and connected services.

A shared dependency can create concentration risk even when a vendor register appears diversified. Several separately purchased AI services may rely on the same workflow platform, model router, library, or cloud infrastructure. A security problem in that common layer can therefore require coordinated action across multiple supplier relationships.

The practical question is whether a supplier can identify the affected component, determine which environments use it, and remediate or isolate it promptly. Customers also need to understand which credentials and permissions the component holds, because software exposure becomes more consequential when it provides a route into other systems.

Diversifying vendors on paper doesn't diversify risk if they all sit on the same plumbing underneath.

What did the MCP analysis find?

Black Kite separately examined 305 publicly discoverable Model Context Protocol (MCP) server entries attributed to 179 AI companies. Across those entries, it recorded 1,732 findings, of which 48.8% were rated High or Critical. Among the 77 Critical findings, 87% involved code or command injection.

MCP gives AI applications a standardized interface to tools and data sources. Depending on the implementation, a connected server can expose functions that read documents, query databases, update records, or run other operations. A vulnerable component with extensive permissions may therefore put more than the AI application itself at risk.

The denominator matters. The 48.8% figure describes recorded findings, not the share of all AI companies or production MCP deployments that are vulnerable. The dataset covers publicly discoverable repositories, packages, and hosted components; domain attribution does not establish live production use, and private MCP environments were outside the analysis.

For enterprise teams, the implication is to inventory connections, limit permissions to the work required, and test how quickly access can be revoked. An external view of a supplier cannot reveal every permission a customer has granted inside its own environment.

Injection flaws in permission-rich MCP servers are the clearest technical red flag in the dataset.

How should readers use these findings without overreading them?

The research was conducted externally, without access to the assessed companies' systems. Critical-vulnerability findings generally match observed software versions with disclosed vulnerabilities; Black Kite did not test exploitation. Botnet-related signals, reported at 6.5% of companies, and unusual network activity, at 44.3%, warrant investigation but do not independently prove a compromise.

Visibility also affects comparisons. In a supplementary Forbes AI 50 cohort, 52% had critical-vulnerability findings and 28% had associated credentials in infostealer records. Larger digital footprints provide more opportunities to observe problems, so those figures should not be treated as a simple ranking of which type of company is safest.

There's also a commercial context worth stating. Black Kite sells third-party cyber-risk intelligence and monitoring, including supplier exposure analysis and ransomware-susceptibility indicators. Its report is vendor-produced research with a stated population and methodology, rather than a census of every AI company or evidence that all flagged systems have been breached.

What's the operational lesson?

The strongest operational takeaway is to assess three connected things together: the supplier, its dependencies, and the access its product receives. That framing treats an AI purchase the way mature procurement teams already treat any other critical vendor — with attention to who's behind it, what's underneath it, and what keys it holds.

The full 2026 AI Supply Chain Report: The Risks Behind Your AI Relationships provides Black Kite's detailed findings and methodology for applying that approach to AI vendor reviews. As AI products gain deeper access to enterprise systems, expect supplier security reviews to move from procurement fine print to a standing part of how companies manage AI adoption.