AI Supply Chain Risk FAQs
AI supply chain risk refers to the cybersecurity exposure organizations inherit through AI suppliers and the technologies those suppliers depend on, including models, software libraries, cloud infrastructure, and integrations with business systems.
A weakness in any of these components can affect organizations relying on the AI product. Black Kite’s 2026 AI Supply Chain Report assessed more than 18,000 AI companies and found known-exploited vulnerabilities at 9.8%.
The findings highlight why organizations must evaluate not only the AI products they adopt, but also the suppliers and underlying technologies supporting them.
Third-party AI risk management is the part of a third-party cyber risk management (TPCRM) program that covers suppliers whose products or services use AI. It assesses the vendor's own security posture, the components its AI product is assembled from, and the customer systems and data the product can reach. Most AI capability is bought rather than built: In Menlo Ventures' 2025 survey, 76% of organizational AI use cases were purchased from vendors.
An AI vendor assessment combines an external view of the vendor's security posture with questions only the vendor can answer. From the outside, a program can measure unpatched software, vulnerabilities on the CISA KEV catalog and missing email authentication. Black Kite identified critical vulnerabilities at 34.2% of AI companies. From the vendor, the program needs to learn which components the product depends on and which customer systems it connects to.
Not necessarily. Infostealer findings indicate that corporate login information associated with a company has appeared in records collected by information-stealing malware.
Corporate login information associated with 6.8% of AI companies appeared in infostealer records, including credentials related to company services and third-party business applications.
The findings do not automatically establish that the supplier's own infrastructure was compromised. However, exposed credentials can create opportunities for unauthorized access and should be investigated, particularly when they relate to systems supporting customer services.
Black Kite's findings point to five questions. Which open source tools and models does the product depend on, and how does the vendor learn when one is compromised? Which of our systems does the product connect to, with what permissions, and how fast can that access be revoked? Does the product run Model Context Protocol (MCP) servers, and how are they authenticated? How quickly are known exploited vulnerabilities patched? Where can a security researcher report a flaw?
It can, through its suppliers. Vendors build AI into the products and services an organization buys, so exposure arrives through them whether or not the organization runs AI programs of its own. In the UK financial sector, the Bank of England and the Financial Conduct Authority found that a third of AI use cases at 118 firms were third-party implementations, up from 17% in 2022.
Model Context Protocol (MCP) servers allow AI applications to interact with external tools, data sources, and business systems. Depending on their configuration and permissions, these connections may provide access to sensitive information or allow actions to be performed in connected environments.
Black Kite's separate MCP analysis covered 1,732 findings across 305 MCP server entries attributed to 179 AI companies; 48.8% of those findings were rated High or Critical. Among Critical findings, 87.0% involved code or command injection, while 13.0% involved data exfiltration. These percentages describe findings in MCP-related components, not the proportion of AI companies affected.
These weaknesses demonstrate why organizations should evaluate the security of AI integrations, the permissions they receive, and the systems they can access.
Yes. CISA added CVE-2025-68613, a remote code execution vulnerability affecting the n8n workflow automation platform, to its Known Exploited Vulnerabilities catalog on March 11, 2026.
The vulnerability affects n8n's workflow expression evaluation system and can allow an authenticated attacker to execute unauthorized code under certain conditions.
Black Kite identified this vulnerability at 93 AI companies.
Because n8n is widely used to automate workflows and connect business applications, organizations should ensure affected versions are updated and review the security of integrations and credentials managed through the platform.
In March 2026, attackers published compromised versions of LiteLLM, an open-source tool used to connect applications with language models. The malicious packages were designed to harvest credentials from environments that installed them.
Mercor, an AI training-data company, disclosed a security incident connected to the attack. In its completed investigation published on June 25, 2026, Mercor reported that sensitive information relating to a very limited subset of its experts was affected, that the impact on customer information was very limited, and that no employee data was affected.
LiteLLM-related FocusTags appeared at seven AI companies. These findings indicate potential exposure associated with the technology, not confirmed involvement in the Mercor incident.
The case illustrates how a compromised software dependency can introduce risk into an AI supplier's environment and potentially affect the organizations relying on its services.
Between August 8 and 18, 2025, attackers used stolen OAuth tokens for Drift, an AI chat tool sold by Salesloft, to export data from the Salesforce environments of companies that had integrated it. Google estimated that more than 700 companies may have been targeted. For third-party cyber risk programs, the incident showed that an AI tool's integration can hold standing access to customer data that no external scan of the vendor reveals.
China’s AI companies show a greater concentration in models, computing infrastructure, and data services: 22.5%, compared with 11.3% in the United States. Industrial and physical-world applications also represent a larger share, at 22.7% versus 5.3%.
The US group has a stronger concentration in everyday business applications, at 32.5%, compared with 13.1% in China.
Security findings also differ. Critical vulnerabilities appeared at 54.5% of China’s AI companies and 28.7% of US AI companies. The shares reaching Black Kite’s critical ransomware susceptibility threshold were 48.5% and 24.3%, respectively.
Known exploited vulnerabilities were similar in both: 8.6% of China's AI companies and 8.2% of US AI companies, or 5.3% and 4.4% excluding HTTP/2 Rapid Reset.
Yes. HTTP/2 Rapid Reset (CVE-2023-44487) is a denial-of-service vulnerability that attackers can exploit to overwhelm affected services with large volumes of requests.
Black Kite counted this vulnerability only where a direct check confirmed HTTP/2 was enabled: 963 companies (5.3%), which account for 54% of the companies with a known exploited vulnerability.
The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog. Its primary concern is service availability, making it particularly relevant when customers depend on an AI supplier for business-critical operations.
Yes. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of critical flaws in the PHP runtime disclosed on October 21, 2026, allowing unauthenticated remote code execution on affected web servers.
In the week after the fixes were released, Black Kite's scans flagged affected PHP versions at 939 of the AI companies in this study, 5.2%, with the highest shares in Taiwan (9.9%) and China (8.6%).
The finding is based on software versions and describes potential exposure.
Organizations should confirm that their AI suppliers have applied the October 21 fixes.
Continuous monitoring helps organizations detect changes in an AI supplier's cybersecurity posture between scheduled assessments.
Black Kite enables organizations to monitor suppliers for critical vulnerabilities, known-exploited vulnerabilities, ransomware susceptibility, suspicious network activity, and exposed corporate credentials.
FocusTags help identify suppliers potentially affected by important emerging threats, while the Ransomware Susceptibility Index provides additional context for prioritizing ransomware exposure.
When significant findings appear, organizations can engage suppliers through The Bridge to request clarification and track remediation.
Combined with direct supplier assessments and appropriate controls over AI integrations, continuous monitoring helps organizations respond to changing risks throughout the supplier relationship.
NEXT: Find more details and data about the AI ecosystem.