One in three AI vendors carries a critical unpatched flaw

Thirty-four point two percent of AI companies worldwide — more than one in three — carry at least one critical unpatched vulnerability, according to Black Kite's "2026 AI Supply Chain Report: The Risks Behind Your AI Relationships," which examined 18,160 AI suppliers across every size band, from firms with fewer than ten employees to those with more than 1,000. The findings land at a moment when enterprises are pouring record sums into externally purchased AI: Menlo's 2026 research puts enterprise AI spend at $37 billion in 2025, with 76% of enterprise AI solutions bought rather than built in-house.

The stakes are straightforward. Every AI component integrated into a corporate platform inherits the supplier's weaknesses, and every additional integration — software components, open-source tooling — widens the attack surface. Black Kite's researchers, after reviewing the companies themselves along with their software, integrations, and components, found failures to patch critical vulnerabilities, protect credentials, authenticate users and email, and address network security issues.

What did the study actually measure?

Black Kite analyzed 18,160 AI companies worldwide, determining each firm's AI involvement through reviews of products, services, and primary business activities. The companies fall into six broad groups:

• Everyday application development
• AI development and implementation
• AI applications in specialized sectors such as healthcare, IT, and finance
• Industrial organizations
• AI foundations working on data, compute, and modeling

A small percentage of assessed companies remain "unclassified," and the study excluded businesses that use AI only incidentally. The scope matters: this is not a sample of frontier labs but a census of the AI vendor ecosystem that enterprises actually buy from.

How bad are the headline numbers?

The report's statistics describe systemic hygiene failures rather than exotic attack techniques. The core figures:

• Critical, unpatched vulnerabilities: 34.2% of assessed companies had at least one. Black Kite notes that critical flaws do not always translate to critical business risk, but each should undergo a risk review depending on its nature.
• Email security: 61.7% of AI companies had DMARC issues (the email authentication protocol that prevents domain spoofing), and 37.3% had DKIM weaknesses (the cryptographic signature standard for validating email). Both can be abused for impersonation and phishing.
• Ransomware susceptibility: 29.7% of companies were highly susceptible. On the firm's susceptibility index, almost a third of AI suppliers operate in environments with "heightened exposure" to ransomware attacks.

Network-level signals reinforce the pattern. Unusual network activity was detected at 44.3% of organizations, and botnet-related activity was recorded at 41.8% of the AI companies assessed.

Why do stolen credentials change the calculation?

The damage is not confined to the AI application itself. Black Kite emphasizes that AI suppliers often hold access to customer data, developer environments, business infrastructure, and enterprise platforms. If a supplier's credentials are stolen, that access can expose its customers to a range of cyberattacks.

The credential data is specific. Researchers found that 19.9% of AI companies offering solutions for enterprise AI deployment had corporate login information appearing in infostealer records — the logs compiled by malware that harvests passwords and session tokens from infected machines. Across the entire study population, stolen corporate logins were linked to 6.8% of AI suppliers.

Visibility compounds the problem. According to the report, 33.2% of the AI companies assessed have a "limited" digital footprint, spanning their domains, subdomains, and IP addresses. A customer cannot monitor what it cannot see.

What did the Model Context Protocol analysis find?

In a companion analysis, Black Kite examined AI firms' use of Model Context Protocol (MCP) components — the connective layer that links AI applications to business systems. Of 1,732 logged security findings, 48.8% were rated High or Critical, including code and command injection vulnerabilities.

That number deserves attention. Nearly half of the security findings in the very layer that grants AI agents access to enterprise systems are High or Critical — and injection vulnerabilities in that position can translate directly into unauthorized execution on connected infrastructure.

Why does this matter for enterprise buyers?

AI's core business appeal rests on integration: the technology plugs into existing software and platforms to handle manual tasks, heavy lifting, and tedious, time-consuming work, freeing employees to focus on work requiring human oversight. But integration is precisely what transmits supplier risk into the buyer's environment.

The economics amplify the exposure. With enterprise AI spend at $37 billion in 2025, half of overall spend going to AI apps, and 76% of solutions purchased rather than built, most enterprises are inheriting third-party security postures they never audited. Rogue AI incidents have already hit "tens of thousands," a separate ZDNET report notes, raising the question of whether businesses can trust these tools at all.

How should businesses respond?

Black Kite's recommendations mirror established third-party risk practice, applied continuously rather than once. The guidance:

• Monitor continually. A single point-in-time security assessment is not enough; frequent monitoring reveals issues as they emerge.
• Engage suppliers directly. Understanding their technologies and dependencies surfaces potential security problems before exploitation.
• Prioritize remediation. Handle ransomware-related exposures and vulnerabilities actively exploited in the wild first.
• Audit integrations and access. Review an AI tool's integrations and components, what data it can reach, and the potential impact of exploitation.
• Weigh risk against reward. With that information in hand, decide whether the AI tool justifies the attack exposure it introduces.
• Limit permissions. If the tool stays, restrict its permissions and access to the minimum it requires.

The report's underlying message is that impressive AI applications do not automatically equate to safe ones, and that AI companies worldwide are failing to reach basic security standards. For enterprises, supply chain monitoring is now a precondition of AI adoption, not an afterthought — and as enterprise AI spend keeps climbing, the vendors that can demonstrate patched systems, protected credentials, and authenticated email will be the ones that survive procurement scrutiny.