Layer 1: The AI company
Unpatched and Exploited: Known Weaknesses Attackers Already Use
One of the clearest questions about an AI supplier is whether critical weaknesses in its internet-facing systems remain unresolved. Depending on the vulnerability, attackers may be able to access sensitive information, execute unauthorized code, or disrupt services that customers rely on.
Black Kite identified at least one critical unpatched vulnerability at 34.2% of the AI companies in the study.
A vulnerability is counted as critical when an internet-facing system, whether an application, an operating system, or a network device such as a router or firewall, is observed running a software version with publicly disclosed, critical-severity vulnerabilities that remain unpatched. The flaws in this category typically allow remote code execution, denial of service, or data theft. Black Kite does not test exploitation; the findings describe potential exposure identified from the outside.
A smaller group carries a particularly important category of security weakness: vulnerabilities that attackers have already exploited in real-world attacks.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintains the Known Exploited Vulnerabilities (KEV) catalog, a list of software vulnerabilities with confirmed evidence of exploitation.
Black Kite identified at least one vulnerability from CISA’s Known Exploited Vulnerabilities catalog at 9.8% of the AI companies in the study, one in ten.
This distinction matters. These are vulnerabilities with a documented history of exploitation, giving third-party cyber risk teams concrete reasons to prioritize remediation.
A Few Known Vulnerabilities Account for Much of the Exposure
Known-exploited vulnerability exposure is heavily concentrated.
Just ten vulnerabilities account for about nine in ten recorded company-vulnerability matches.
A relatively small set of widely known weaknesses therefore contributes to a large share of the observed exposure.
One example is HTTP/2 Rapid Reset, a vulnerability that can be used to overwhelm services and disrupt their availability. Because the attack only works where HTTP/2 is enabled, Black Kite did not rely on software versions alone and counted the vulnerability only where a direct check of the company’s internet-facing systems confirmed the precondition. On that basis it was present at 963 AI companies, 5.3% of the study and 54% of the 1,771 companies with a known exploited vulnerability. The second most common is CVE-2024-38475, a 2024 flaw in the Apache HTTP Server, found at 703 AI companies; unlike Rapid Reset, it can expose files and data on the affected server.
Many of these vulnerabilities are publicly documented and have available fixes. This gives a practical starting point: ask suppliers about specific security issues, verify remediation plans, and determine whether the affected services are important to business operations.
As this report went to press:
PHP2Shell
On October 21, 2026, the PHP project released fixes for two critical flaws in the PHP runtime itself, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both allow unauthenticated remote code execution on affected web servers; exploitation attempts were observed before public disclosure, and proof-of-concept code circulated within hours.
In the week after the fixes, Black Kite’s scans flagged affected PHP versions on the internet-facing systems of 939 AI companies in this study, 5.2%, with the highest shares in Taiwan (9.9%) and China (8.6%) and the lowest in the United States (3.4%).
None of these companies chose PHP as an AI decision; it sits underneath their websites, APIs, and admin panels. That is what concentration risk looks like in practice: a component nobody lists as part of the AI product becomes everybody’s emergency on the same day. The flag is based on software versions and describes potential exposure, and it is exactly the kind of signal a third-party cyber risk program should act on the week it appears.
One Known Vulnerability Can Still Be a Major Problem
The number of vulnerabilities found at a supplier does not necessarily tell the full story about the risk it creates for customers.
About 84% of the 1,771 companies with a known exploited vulnerability had exactly one recorded KEV, while fewer than 2% had five or more. But even a single vulnerability can have serious consequences if it affects a critical system or a service handling sensitive information.
The priority is understanding what those weaknesses could allow an attacker to do, which services are affected, and how the supplier plans to address them.
Basic Email Security Remains a Widespread Gap
Email authentication is one of the most basic layers of corporate cybersecurity. Three published records tell the world’s mail servers which messages genuinely come from a company’s domain: SPF lists the servers allowed to send mail on the domain’s behalf, DKIM adds a digital signature that proves a message was not altered in transit, and DMARC tells receiving servers what to do when a message fails those checks. Together they make it much harder for an attacker to send email that appears to come from the company, which is the starting point of most phishing and payment-fraud campaigns.
Across the AI companies in the study, Black Kite found DMARC weaknesses at 61.7%, DKIM weaknesses at 37.3%, and SPF weaknesses at 11.2%. The three records are independent, so a company may fail one while passing the others, and the share failing all three is far smaller than any single figure. The pattern is familiar: the record that is easiest to publish, SPF, is mostly in place, while the one that actually enforces a policy, DMARC, is missing or misconfigured at six in ten companies.
The scale of these findings highlights a fundamental challenge: companies developing sophisticated AI technologies can still have weaknesses in basic security protections that help safeguard employees, customers, and business partners.
Next: Unpatched systems show what attackers can reach.
The next set of signals shows what may already be happening.