2026 AI Supply Chain Report: The Risks Behind Your AI Relationships
An outside look at the security of more than 18,000 AI companies, what they build, where they build it, and the risks their customers inherit.
By the Black Kite Research Group™
This report is built to explore interactively below. For a static copy, download a PDF of this report.
Introduction
Organizations are increasingly buying AI capabilities rather than building every solution internally. Menlo Ventures’ 2025 research found that 76% of organizational AI use cases were purchased from vendors rather than built in-house, up from 53% a year earlier. The number of AI tools inside each organization is rising with it, and the next wave, agentic AI, gives those tools the ability to act on an organization’s systems and data on its behalf.
Every one of those purchases is a supplier relationship.
When a company adopts an AI service, it is not only acquiring a capability; it is handing its data, parts of its business processes, and sometimes direct access to its systems to another company.
Speed is the real pressure on AI risk
Commentary by Dr. Ferhat Dikbiyik, Chief Research & Intelligence Officer, Black Kite
AI adoption is moving faster than cyber due diligence. In heavily regulated industries like finance, I see more care. Many institutions have AI governance committees and formal review. Most organizations don’t have that level of scrutiny, and SMBs often have very little.
Even careful teams are still learning. GenAI models are non-deterministic, so we can’t predict every problem we will face, and the pressure to move faster doesn’t let up.
My view is that the answer is not to slow down. Due diligence shouldn’t be skipped, and it shouldn’t become the bottleneck either. It has to keep pace with adoption, and that takes visibility that is continuous, not periodic.
Behind that company sits a supply chain of its own: The models it runs, the open source components it builds on, and the integrations through which its product reaches into customer environments. A weakness anywhere in that chain can affect the customer, including through software or services the customer never purchased directly.
Much of the public conversation about AI security is about what AI itself might do. This report is about something more immediate for a third-party cyber risk management (TPCRM) team: who the companies selling AI actually are, what they build, and what their customers inherit when they sign.
To answer that, Black Kite assessed the cybersecurity of more than 18,000 AI companies worldwide and examined what they build, where they operate, and the risks their customers may inherit.
The report examines three connected layers:
1.
The AI company itself
2.
The components its products depend on
3.
The integrations through which those products access business systems
The findings point to a practical conclusion: Assess the supplier behind the capability. An innovative AI product does not remove the need for the supplier to patch its systems, protect its credentials, and control what its product can reach inside a customer’s environment.
Key Findings
Who’s building AI
The United States and China have different profiles in AI development. Business applications account for
of US AI companies, compared with 13.1% in China.
China’s AI companies show a stronger concentration in models, computing infrastructure, and data services, at
versus 11.3% in the US, and in industrial applications, at 22.7% versus 5.3%.
Layer 1: The AI company
One in three AI companies has a critical unpatched vulnerability. Black Kite identified critical vulnerabilities at
of the more than 18,000 AI companies in the study. One in ten (9.8%) had a vulnerability listed in CISA's Known Exploited Vulnerabilities catalog.
More than four in ten AI companies show unusual network activity. Black Kite identified network behavior that departed from a company’s own baseline at
of the AI companies in the study, and Botnet Infection findings at 6.5%.
Three in ten AI companies reach Black Kite’s critical ransomware susceptibility threshold. Across all AI companies in the study,
had a Ransomware Susceptibility Index® (RSI®) at or above 0.4. In China, that share reached 48.5%, compared with 24.3% in the United States.
5 out of every 100 companies in this range become ransomware victims.
Stolen corporate login information was associated with
of AI companies. Black Kite identified more than 18,600 related finding records, involving company services and third-party business applications used by employees.
Layer 2: The components
A compromised component reaches an AI supplier’s customers. AI products are assembled from shared tools that hold the credentials connecting them to other systems. Black Kite found CVE-2025-68613, a known exploited remote code execution flaw in the n8n workflow platform, at
AI companies, and the March 2026 LiteLLM compromise showed the path in practice: a poisoned package reached AI data provider Mercor, and through Mercor’s systems, its customers.
Layer 3: The integrations
AI integrations create a powerful new attack surface. In Black Kite’s separate analysis of Model Context Protocol (MCP) components, the software that connects AI applications to business systems,
of the 1,732 recorded security findings were rated High or Critical. Among the 77 Critical findings, 87.0% involved code or command injection, highlighting the potential risks to the systems and information those connections reach.
TABLE OF CONTENTS
01 | INTRODUCTION
Most AI is bought, not built. What you inherit when you sign.
02 | Who is Building AI
18,000+ companies, six groups, and what each region specializes in.
Layer 1: The AI company
03 | Unpatched and Exploited
One in three AI companies carries a critical vulnerability.
04 | Beyond Patching
Botnet findings, stolen credentials, ransomware susceptibility, and who carries the most risk.
05 | The Forbes AI 50
Market recognition is not a security assessment.
Layer 2: The components
06 | AI Suppliers Have Suppliers
Shared components, concentration risk, and the LiteLLM compromise.
Layer 3: The integrations
07 | MCP and Integration Access
When an AI tool becomes a path into your systems.
08 | What to Do Next
Six actions to identify, prioritize, and reduce AI supplier risk.
09 | Methodology
How the research was conducted and how to read it.
10 | FAQ
Quick answers to the questions TPCRM professionals ask most.
11 | Appendix
Security findings by company size, age, and funding.
Key Findings:
Who’s building AI
- The United States and China have different profiles in AI development. Business applications account for 32.5% of US AI companies, compared with 13.1% in China. China’s AI companies show a stronger concentration in models, computing infrastructure, and data services, at 22.5% versus 11.3% in the US, and in industrial applications, at 22.7% versus 5.3%.
Layer 1: The AI company
- One in three AI companies has a critical unpatched vulnerability. Black Kite identified critical vulnerabilities at 34.2% of the more than 18,000 AI companies in the study. One in ten (9.8%) had a vulnerability listed in CISA's Known Exploited Vulnerabilities catalog.
- Botnet Infection and unusual network activity extend the risk picture beyond software vulnerabilities. Botnet Infection findings appeared at 41.8% of the AI companies in the study, while 44.3% of them showed network activity that departed from their normal patterns.
- Three in ten AI companies reach Black Kite’s critical ransomware susceptibility threshold. Across all AI companies in the study, 29.7% had a Ransomware Susceptibility Index® (RSI®) at or above 0.4. In China, that share reached 48.5%, compared with 24.3% in the United States.
- Stolen corporate login information was associated with 6.8% of AI companies. Black Kite identified more than 18,600 related finding records, involving company services and third-party business applications used by employees.
Layer 2: The components
- A compromised component reaches an AI supplier’s customers. AI products are assembled from shared tools that hold the credentials connecting them to other systems. Black Kite found CVE-2025-68613, a known exploited remote code execution flaw in the n8n workflow platform, at 93 AI companies, and the March 2026 LiteLLM compromise showed the path in practice: a poisoned package reached AI data provider Mercor, and through Mercor’s systems, its customers.
Layer 3: The integrations
- AI integrations create a powerful new attack surface. In Black Kite’s separate analysis of Model Context Protocol (MCP) components, the software that connects AI applications to business systems, 48.8% of the 1,732 recorded security findings were rated High or Critical. Among the 77 Critical findings, 87.0% involved code or command injection, highlighting the potential risks to the systems and information those connections reach.
How to Read These Findings
These findings describe externally observed security conditions, not confirmed compromise at every company. Company percentages refer to the stated research population. MCP percentages describe findings in publicly discoverable components, not the prevalence of vulnerable production deployments. Ransomware susceptibility is an indicator used to prioritize review, not a probability of an attack.
Next: AI adoption happens in a sequence.
First you choose a company. Then you choose which of its components your product will use. Then you connect it to your systems. Start by understanding what kind of companies these are.