al-ice.ai

One in Three AI Vendors Ships a Critical Unpatched Flaw: Black Kite Grades 18,160 Suppliers

Agent & Supply Chain Security by al-ice.ai Editorial

On 10 November 2026 the Black Kite Research Group published its 2026 AI Supply Chain Report, an outside-in security assessment of 18,160 AI companies worldwide — and the headline numbers are bleak. 34.2% carry at least one critical unpatched vulnerability on internet-facing systems; 9.8% — 1,771 companies — carry a flaw from CISA’s known-exploited catalog; and 29.7% sit at or above Black Kite’s critical ransomware-susceptibility threshold. The report works through three layers — the AI company itself, the components its product is built on, and the integrations reaching into customer environments — on the premise that most enterprise AI is bought, not built, so every contract imports the supplier’s entire cyber supply chain. Charlie Osborne’s ZDNet coverage the same day frames it as a “widespread cybersecurity weakness” across the AI ecosystem. Read the percentages as what they are — an attacker’s-eye view from the outside, produced by a vendor that sells third-party risk monitoring — but the underlying counts are specific enough to take seriously.

Patching: one in three critical, one in ten already exploited

The patching layer is where the report hits hardest. A third of assessed AI companies expose a critical-severity, publicly disclosed vulnerability, and nearly one in ten exposes one with a documented history of real-world exploitation. The report’s freshness case study is PHP2Shell: Black Kite scans found PHP versions affected by the newly disclosed flaws on the internet-facing systems of 939 AI companies — 5.2% of the study — within a week of the 21 October 2026 patch, with the highest shares in Taiwan (9.9%) and China (8.6%) and the lowest in the United States (3.4%). This site tracked the PHP2Shell disclosure and patch wave through October, including the CVE-2026-109618 and CVE-2026-109619 patches and Unit 42’s agentic post-exploitation findings — the Black Kite census shows how fast one widely used component becomes ecosystem-wide exposure, faster than most assessment cycles can detect.

The component layer extends the same logic to the AI stack itself. Black Kite’s FocusTags tie 105 AI companies to findings in n8n, Langflow, or LiteLLM: 93 exposed to n8n remote-code-execution CVE-2025-68613 (CISA KEV-listed since March 2026), five carrying Langflow findings, seven LiteLLM-related. LiteLLM was the vector of the March 2026 supply-chain attack that reached Mercor’s customers — covered here in the May attack-chain briefing and the original breach report — and n8n’s agent-chat surface drew a fourteen-CVE batch of its own in October. These tools sit between AI applications and business services, often handling credentials and workflows, so a compromised one exposes every supplier built on it.

Ransomware posture, and signals that something is already happening

On Black Kite’s Ransomware Susceptibility Index, 29.7% of AI companies score at or above the 0.4 critical threshold — rising to 37.8% among companies with a visible footprint, roughly in line with manufacturing, healthcare, and IT vendors. At the high end AI companies stand out: 11.5% score 0.6 or above, against 4.6% to 10.3% in the reference groups, and in Black Kite’s analysis of ransomware victims from April 2025 to March 2026 the top band carried 291 times the attack rate of the bottom band. The named case is Straive, a Singapore-based AI data and content provider that appeared on the Qilin leak site in February 2026 with an index score above the critical threshold since November 2025 — three months of warning, then a listing, then a score near 0.9.

Patching tells you what an attacker can reach; three further signals suggest what may already be underway: 44.3% of companies show unusual departures from their network baselines, 6.8% have corporate credentials in infostealer records (over 18,600 finding records), and 6.5% hold IP addresses linked to reported botnet activity. None of these confirms compromise on its own — the report says so explicitly — but they are the patterns that typically accompany data theft or command-and-control traffic. ZDNet’s coverage adds that 19.9% of companies offering enterprise AI deployment had corporate logins in infostealer records, which is the number that should worry buyers: supplier credentials are customer attack surface.

The integration layer: nearly half of MCP findings rate High or Critical

The report’s most on-the-beat finding for this site is its separate MCP analysis: 1,732 findings across 305 publicly discoverable MCP server entries attributed to 179 AI companies, of which 48.8% rate High or Critical. Among the 77 Critical findings, 87.0% involve code or command injection; the remainder involve data exfiltration. MCP components are the software letting AI applications act on databases and business platforms — exactly the integration layer whose compromise turns one supplier incident into many customer incidents. It lands alongside Corelight’s dependency-drift warning and the unpinned-config census: the ecosystem keeps wiring powerful, rarely reviewed components straight into production data.

Bought, not built — and barely visible

Structure matters as much as hygiene. Black Kite sorts the 18,160 companies into six groups — everyday business applications (31.3%), development and implementation services (22.7%), specialized sectors (14.3%), content and consumer AI (13.1%), AI foundations (10.0%), and industry/physical world (6.9%) — and notes the application builders and implementers, the suppliers enterprises actually contract with, are more than half the population, while the foundations holding most of the money (over four-fifths of $632 billion in disclosed funding) are a tenth of it. Menlo’s 2026 research, via ZDNet, puts enterprise AI spend at $37 billion in 2025 with 76% of solutions purchased rather than built. Visibility compounds the risk: 33.2% of assessed AI companies have a “limited” digital footprint, and ZDNet reports 61.7% had DMARC issues and 37.3% DKIM weaknesses — basic email authentication, the kind of miss that enables impersonation and phishing against customers. Those email figures come from ZDNet’s writeup rather than the report page sections we read directly, and are carried as reported.

Read it as a vendor selling the cure

The necessary grain of salt: Black Kite sells the continuous monitoring the report prescribes, and every finding is external-scan data — the same view a buyer’s risk team has, which is both the report’s honesty and its limit. It cannot see internal controls, and “critical vulnerability” on an internet-facing box is exposure, not confirmed breach. But that cuts both ways, and it is why this report pairs well with Gravitee’s accountability-gap survey: one survey says enterprises cannot say who owns agent risk, the other says the suppliers holding that risk patch like it is someone else’s problem. The throughline to the Qubole cross-account abuse is direct — standing integrations and inherited trust are where supplier posture becomes customer incident.

What to actually do

  1. Monitor suppliers continuously, not at signing. Point-in-time assessments miss a PHP2Shell-style week. Track KEV-listed and ransomware-relevant exposure across AI vendors the way you track your own perimeter.
  2. Prioritize what attackers already use. The 9.8% with known-exploited flaws and the high-RSI band come first — the report’s own 291x attack-rate spread says where the risk concentrates.
  3. Audit the integration, not just the application. Inventory MCP servers and connectors a supplier’s product holds into your environment, what data each can reach, and what happens if it is compromised — then cut what the task does not require.
  4. Verify identity controls and shrink blast radius. Treat DMARC/DKIM gaps and infostealer-linked credentials as phishing and account-takeover risk to your staff, and scope supplier access and credentials to least privilege with rotation plans.

Our verification was read-only. We read the Black Kite 2026 AI Supply Chain Report page first-hand in full (published 10 November 2026; 18,160 companies; six-group split; 34.2% critical unpatched; 1,771/9.8% KEV; PHP2Shell CVE-2026-109618/109619 figures including 939-company/5.2% reach and Taiwan/China/US shares; 29.7% RSI figures including the 37.8% visible-footprint, 11.5% high-band, 291x, and Straive/Qilin figures; 44.3%/6.8%/6.5% network signals; 105-company n8n/Langflow/LiteLLM FocusTags including CVE-2025-68613 and the Mercor reference; MCP figures of 1,732 findings, 305 servers, 179 companies, 48.8% High/Critical, 87.0% injection share; 33.2% limited footprint; $632B funding split). ZDNet’s 10 November 2026 coverage by Charlie Osborne (ecosystem framing; 61.7% DMARC and 37.3% DKIM figures; 19.9% enterprise-deployment infostealer figure; Menlo $37B/76% figures) is carried as reported. We scanned nothing, bought nothing, and contacted no vendor. Brave Search was used for discovery only.

Sources: