Most AI capability is bought, not built. Each purchase adds a supplier, and each supplier brings a cyber supply chain of its own. The models it runs, the open source components it builds on, and the integrations that reach into customer systems all travel with the contract.
The Black Kite Research Group assessed the external security posture of 18,160 AI companies worldwide. The research works through three connected layers that a third-party cyber risk management (TPCRM) program has to cover:
The AI company. Its patching, network signals, and stolen credentials.
The components. The workflow tools, model routers, and packages its product is built on.
The integrations. The access its product holds inside your environment.
The results don't flatter the ecosystem. 34.2% of AI companies carry a critical unpatched vulnerability, and 29.7% sit at or above Black Kite's critical ransomware susceptibility threshold. The bigger and better funded the company, the worse those numbers get. Every finding comes from the outside, which is the same view a third-party risk management team has before it signs.
An AI product's sophistication says nothing about whether the company behind it patches its servers or limits what its product can reach. This report is your blueprint for assessing the supplier behind the capability, across all three layers, with continuous monitoring for as long as the relationship lasts.
(No download required)
Key Findings From the 2026 AI Supply Chain Report
One in Ten AI Companies Carries a Vulnerability Attackers Are Already Exploiting
Black Kite found at least one critical-severity, publicly disclosed vulnerability on the internet-facing systems of 34.2% of AI companies. A smaller group, 1,771 companies or 9.8%, carries at least one entry from CISA's catalog of known exploited vulnerabilities, which means the flaw has a documented history of real-world use.
PHP2Shell Reached 939 AI Companies Within a Week of Disclosure
Black Kite’s scans flagged PHP versions affected by the newly disclosed PHP2Shell vulnerabilities on the internet-facing systems of 939 AI companies, 5.2% of the study, with the highest shares in Taiwan (9.9%) and China (8.6%) and the lowest in the United States (3.4%). The two flaws, CVE-2026-109618 and CVE-2026-109619, were patched on October 21, 2026. A single widely used component can create exposure across the ecosystem faster than most assessment cycles can detect it.
Three in Ten AI Companies Reach the Critical Ransomware Threshold
29.7% of AI companies scored at or above the 0.4 critical threshold on Black Kite's Ransomware Susceptibility Index® (RSI®), which measures the externally visible conditions that put a company on ransomware groups' radar. Among AI companies with a visible footprint, 37.8% were at or above the threshold, the same level as the 37% to 39% Black Kite measures in manufacturing, healthcare and IT vendors. At the high end AI companies stand apart: 11.5% scored 0.6 or above, against 4.6% to 10.3% in the reference groups. In Black Kite's analysis of ransomware victims from April 2025 to March 2026, the top RSI band carried 291 times the attack rate of the bottom band.
In February 2026, Straive, a Singapore-based provider of AI data and content services, appeared on the Qilin ransomware leak site. Its RSI had sat above the critical threshold since November 2025, three months before the listing, and rose to nearly 0.9 afterward.
Unusual Network Activity Appears at 44.3% of AI Companies
Patching tells you what an attacker can reach. Three further signals point to what's already happening:
44.3% of AI companies show significant departures from their own network baseline, such as connections to never-before-seen addresses or sudden outbound data spikes.
6.8% have corporateleaked credentials in infostealer records, more than 18,600 finding records in all.
6.5% have IP addresses linked to sources reporting botnet activity.
None of these confirms a compromise on its own. They're the patterns that typically accompany data theft or communication with attacker-controlled servers.
105 AI Companies Carry Findings Tied to n8n, Langflow, or LiteLLM
Black Kite's FocusTags® show where AI products carry exposure from tools the vendor didn't build:
93 AI companies are exposed to CVE-2025-68613, the n8n remote code execution flaw CISA added to its KEV catalog in March 2026.
5 carry Langflow-related findings, four of them with both KEV-listed Langflow vulnerabilities.
7 carry LiteLLM-related findings. LiteLLM was the source of a March 2026supply chain attack that reached Mercor's customers.
Across all three tools, 105 AI companies carry at least one related finding. These tools sit between AI applications and other services, often handling credentials, workflows, or access, so a compromised tool may expose every supplier built on it.
Nearly Half of MCP Security Findings Are Rated High or Critical
48.8% of MCP security findings were rated High or Critical. Black Kite's separate analysis of publicly discoverable Model Context Protocol (MCP) components, the software that lets AI applications act on databases and business platforms, covered 1,732 findings across 305 server entries attributed to 179 AI companies. Among the 77 Critical findings, 87.0% involved code or command injection. The rest involved data exfiltration.
18,160 AI companies assessed externally
34.2% carry a critical unpatched vulnerability
9.8% carry a CISA known exploited vulnerability
29.7% at or above the critical ransomware susceptibility threshold
44.3% show unusual network activity
105 companies with findings tied to n8n, Langflow, or LiteLLM
87.0% of Critical MCP findings involve code or command injection
Who Is Building AI, and Why the Supplier's Role Matters
Everyday Business Applications Are the Largest Group of AI Companies
Black Kite sorted the 18,160 companies into six groups by primary AI activity, ranked here by share of the population:
AI for everyday business operations: 31.3%
Development and implementation for other businesses: 22.7%
Foundations of AI (models, infrastructure, data): 10.0%
Industry and the physical world: 6.9%
The application builders and the implementers together make up more than half of all AI companies, and they're the suppliers most organizations actually contract with. The companies building models, computing infrastructure, and data are a tenth of the ecosystem and most of the money.
Disclosed funding across 4,686 companies totals $632 billion, more than four-fifths of it with that foundations group, and OpenAI, Anthropic, and xAI alone account for two-thirds. The rest of the ecosystem runs on a median of about $2 million.
58% of Large AI Companies Carry a Critical Unpatched Vulnerability
The ecosystem is young and small. 87% of AI companies with a recorded headcount have fewer than 50 employees, and 33.2% have ten or fewer externally visible assets, so observable findings tell you less about them. Every finding in the study rises with company size, and the pattern holds when companies with a limited footprint are excluded. Part of the vulnerability difference is simply more infrastructure to scan. Stolen employee credentials are not, and they rise fastest of all. Among AI companies with more than 50 employees:
58% had a critical unpatched vulnerability, against 34.2% study-wide.
29% had employee credentials in infostealer logs, against 6.8% study-wide.
49% were at or above the ransomware threshold, against 29.7% study-wide.
Companies that have raised more than $250 million show a critical-vulnerability rate of 69%. The established vendors most likely to land in your vendor inventory are the ones most likely to carry exposure, and a vendor risk assessment of a small-footprint supplier has to pair observable findings with direct questions.
China Builds Infrastructure While the US Builds Business Apps
What AI companies build differs more by region than where they sit. Nearly a third of US AI companies (32.5%) build everyday business applications, against 13.1% in China.
22.5% of Chinese AI companies build foundational technology, nearly twice the US share of 11.3%, and the gap sits almost entirely in computing infrastructure. The study includes 129 Chinese computing-infrastructure companies and 119 American ones, even though the US group is six times larger. Industrial AI follows the same split, at 22.7% of Chinese AI companies and 5.3% of US ones.
Stolen Credentials Follow the Supplier's Role
Critical vulnerabilities are spread flat across the six groups, at roughly one in three companies everywhere except consumer AI. Stolen credentials aren't. Infostealer findings track how deep a supplier's work reaches into customer environments, and the highest rates in the study belong to the activities with the deepest reach:
Cloud solution providers, 19.9%. The highest infostealer rate in the study.
Data and labeling companies, 13.9%.
Customer service platforms, 11.5%.
Model and platform developers recorded one of the lowest rates, at 4.1%. The same implementer group with the highest infostealer rate also had the highest share at the critical ransomware threshold, at 32.9%.
What the Outside View Shows About Patching, Infections, and Regions
10 Vulnerabilities Account for Most Known Exploited Exposure
A small number of flaws drive most of the exposure. Ten CVEs account for more than nine in ten recorded company-vulnerability matches, and 84% of the 1,771 companies with a KEV carry exactly one. The most common is HTTP/2 Rapid Reset, a denial-of-service flaw that only works where HTTP/2 is enabled.
Black Kite flagged it by software version at 2,902 companies, then tested the precondition directly on their systems. HTTP/2 was confirmed enabled at 963 companies, 5.3% of the study and 54% of everyone with a KEV. Only the confirmed companies count in the report. Second is CVE-2024-38475 in the Apache HTTP Server, found at 703 AI companies.
Suppliers With Exploited Flaws Are Twice as Likely to Show Botnet Activity
Of the 1,771 AI companies with a known exploited vulnerability, 14.7% also carry Botnet Infection findings, more than twice the 6.5% rate across the full population. The same supplier shows an exploitable weakness and infrastructure already associated with malicious activity.
Email security tells the same story. DMARC, the record that actually enforces a mail policy, is missing or misconfigured at 61.7% of AI companies.
China's AI Companies Have Twice the US Vulnerability Rate
Critical unpatched vulnerabilities appeared at 54.5% of China's AI companies against 28.7% in the US, and the share at the critical ransomware threshold was also twice as high, at 48.5% against 24.3%. Known exploited vulnerabilities sit in a narrow band once Rapid Reset is excluded, at 5.3% in China and 4.4% in the US. Not every measure points the same way. Botnet Infection findings were similar across regions, from 4.6% in India to 7.5% in the United States, with China at 6.1%, and India stands out for exposed credentials at 12.5% of its AI companies, more than double the US rate.
The Forbes AI 50 Score Worse Than the Wider AI Population
Market recognition doesn't change the picture. Black Kite separately assessed 50 companies from the Forbes AI 50:
Critical unpatched vulnerabilities at 52%.
Corporate credentials in infostealer records at 28%.
Botnet Infection findings at 34%.
These companies have larger external footprints than the study population, which creates more opportunity for a finding to appear. What the rates show is that recognition and scale are no guarantee: a supplier's reputation cannot replace an assessment of its actual exposure.
How Shared Components and Standing Integrations Spread One Supplier's Incident
A Malicious LiteLLM Package Reached Mercor's Customers in 40 Minutes
In March 2026, attackers published malicious versions of LiteLLM, an open source tool that routes application requests to language models, to the PyPI package repository. The incident moved through the supply chain in three steps:
The component. The malicious package was downloadable for 40 minutes and harvested credentials from every environment that installed it.
The supplier. Mercor, a supplier of AI training data, installed it. Stolen credentials were used to reach further systems. Mercor disclosed the breach on March 31.
The customers. Mercor's investigation closed in June 2026 and found that sensitive information belonging to a very limited subset of its nearly five million experts was affected.
Mercor's customers had no part in picking LiteLLM. The exposure reached them through a dependency inside their supplier's stack. Five AI suppliers in a vendor register can look independent while resting on the same packages, which makes this concentration risk one level below what the register records.
MCP Gives AI Applications Standing Access to Business Systems
The Model Context Protocol gives AI applications a standard way to query databases, update records, and act on business platforms. Black Kite's analysis covered publicly discoverable MCP repositories, packages, and hosted components attributed to company domains, not private deployments. Of 1,732 findings, 4.4% were Critical and 44.3% High. Code injection made up 51.9% of Critical findings and command injection 35.1%, the kinds of flaw that let an attacker run instructions through the connection an AI tool holds into a customer's systems. In the Forbes AI 50 cohort, MCP entries were associated with 34% of company domains, and 32% of the cohort had at least one vulnerability finding.
Stolen Drift Tokens Exposed Salesforce Data at More Than 700 Companies
The Salesloft Drift incident predates broad MCP adoption and shows what standing integration access does once it's compromised. Attackers obtained the OAuth tokens connecting Drift, an AI chat tool, to its customers' Salesforce environments, and between August 8 and 18, 2025, used them to export data from integrated environments. Google estimated more than 700 companies may have been targeted.
Black Kite's analysis of the Salesloft Drift incident draws the lesson for TPRM teams: a vendor's own external security posture won't surface the standing access its integrations hold inside your systems. That access is part of your own exposure, the kind of cascading risk a TPCRM program manages by reviewing integration permissions on a schedule, since access granted at onboarding tends to outlive the reason it was granted.
How to Build an AI Supplier Risk Program in Four Steps
The report closes with six actions mapped to the three layers. They consolidate into four moves for a TPCRM program.
Sort AI Suppliers by Role Before You Assess Them
Role predicts risk, so classification comes first. Flag every supplier that provides AI capability, including AI features built into products that aren't marketed as AI, and record what each product does, what it processes, and whether it reaches into your systems. A model provider, a custom AI builder, and a packaged application warrant different questions. Where the external footprint is small, treat observable findings as the opening question and fill the gap with direct assessment.
Prioritize Known Exploited Vulnerabilities and Ransomware Susceptibility Over Raw Finding Counts
Start with the 9.8% carrying KEV-listed flaws. A documented exploitation history makes a finding easy to prioritize and hard for a supplier to deprioritize. Ask for a remediation date, not an acknowledgment, and track each finding to confirm remediation through The Bridge®. Then measure every AI supplier against the critical ransomware threshold, cross that list with business context, and escalate the overlap first.
Treat Botnet and Credential Findings as Questions for the Supplier
An IP reputation match doesn't confirm a compromise, and neither does a credential in an infostealer log. They're evidence that starts a targeted review instead of a scheduled one. Ask whether the activity was investigated, whether affected credentials were rotated, whether customer-facing services were involved, and what changed afterward. Prioritize suppliers carrying more than one signal, and keep vendor risk monitoring running between assessments so the questions get asked when a finding appears.
Map Shared Components as Concentration Risk and Limit What Every AI Integration Can Reach
Ask every AI supplier which models, libraries, workflow platforms, and cloud infrastructure its product depends on, and how it learns when one is compromised. Nth-party visibility surfaces the dependencies several suppliers share before an incident does. At the integration layer, inventory every system each AI product connects to, apply least privilege, ask whether the product runs MCP servers and how they're authenticated, and confirm the revocation procedure works before you need it. Permissions granted inside your own environment sit outside any external view, so review them on a schedule as part of your supply chain cyber risk management program.
How Black Kite Built the 2026 AI Supply Chain Report
18,160 AI Companies Assessed From the Outside
Black Kite built the study population from a widely used commercial company database, including a company when its category metadata identified it as an AI company or referenced AI technologies, then reviewed each candidate's business description and public website to confirm AI is central to its products.
Every assessment was conducted externally, without access to company systems, and findings describe potential exposure rather than confirmed compromise. Company security observations draw on Black Kite platform data from September and October 2026.
Six Activity Groups Classified From Products and Public Descriptions
AI activity was determined through business and technology classifications and a review of company products, then presented in six groups with a small unclassified category. Geographic comparisons use recorded headquarters, with Taiwan reported separately from China. Company size is available for 86% of companies, founding year for 88%, and disclosed funding for 26%.
KEV Matches Verified Against CISA's October 8, 2026 Catalog
Critical vulnerabilities are identified by matching observed versions of internet-facing software, operating systems, and network devices against publicly disclosed, critical-severity CVEs. Rapid Reset is counted only where a supplementary scan of 13,347 internet-facing assets confirmed HTTP/2 was enabled. Unusual network behavior is identified from NetFlow records compared against each company's own historical baseline.
Ransomware Susceptibility Benchmarked Against Four Reference Industries
Industry comparisons draw on Black Kite assessments of 632 manufacturing vendors, 735 healthcare vendors, 2,690 IT vendors, and 10,000 finance vendors. MCP results come from a separate dataset of publicly discoverable components, with severity percentages describing findings rather than companies. Forbes AI 50 results describe a separate supplementary cohort of 50 companies.
(No download required)
Related Resources
Research from the same family and adjacent topics:
