34% of AI Suppliers Carry Critical Unpatched Flaws, Black Kite Finds

Black Kite's external assessment of 18,160 AI companies found critical unpatched vulnerabilities at 34.2% of them — and email-authentication weaknesses at an even larger share. The 2026 AI Supply Chain Report: The Risks Behind Your AI Relationships, drawing on September and October 2026 data, concludes that the companies selling advanced AI often carry very ordinary cybersecurity problems.

"The AI supply chain isn't failing in exotic ways. It's failing in ordinary ones," said Ferhat Dikbiyik, Black Kite's chief research and intelligence officer. The report puts patching, credential protection, and integration access at the center of the AI vendor debate.

What did the scan actually find?

Black Kite built its population from a commercial company database and confirmed AI was central to each firm's products. The headline numbers:

• 34.2% of companies had at least one externally observed critical unpatched vulnerability.
• 9.8% had a flaw listed in CISA's Known Exploited Vulnerabilities catalog.
• 61.7% showed DMARC weaknesses; DKIM and SPF weaknesses appeared at 37.3% and 11.2% respectively. Those figures overlap and shouldn't be added together.
• 29.7% reached or exceeded 0.4 on Black Kite's Ransomware Susceptibility Index, the company's critical threshold.
• 6.8% had corporate login information appear in records collected by information-stealing malware.

Each measure answers a different question, and the report is careful about it. A KEV-listed flaw proves documented exploitation somewhere in the world — not that this supplier was attacked. The ransomware score prioritizes review; it doesn't predict which company gets hit. Even sophisticated AI vendors run ordinary corporate domains, so weak DMARC enforcement makes impersonation easier regardless of how clever the product is.

Why does the supplier's role matter more than its branding?

The report splits the ecosystem into six activity groups. Foundational technologies — models, compute, data services — account for roughly 10% of the population. Everyday business applications represent about 31%, and companies building or implementing AI for others make up roughly 23%.

That's why watching only the big-name model providers misses most of your exposure. Integrators, cloud providers, data handlers, and customer-service platforms sit close to customers' systems and information.

Credential findings sharpen the point. Black Kite found corporate logins in infostealer records at 19.9% of cloud AI solution providers versus 4.1% of model and platform developers — nearly five times the rate. Data and labeling companies stood at 13.9%, customer-service platforms at 11.5%. The question isn't whether every exposed login was used; it's what those credentials could still unlock, and whether they touch a production environment or an unrelated business tool.

What hides underneath the product?

The second layer of the report examines dependencies. Black Kite identified 105 AI companies with findings tied to n8n, Langflow, or LiteLLM — middleware that sits between models, workflows, and connected services. Shared dependencies create concentration risk: several separately purchased AI services can rest on the same workflow platform, and one flaw there forces coordinated action across multiple supplier relationships.

The practical test is whether a supplier can identify an affected component, map which environments use it, and remediate fast. Customers also need to know what credentials and permissions that component holds, because software exposure gets more dangerous when it opens a route into other systems.

How risky are MCP integrations?

Black Kite separately examined 305 publicly discoverable Model Context Protocol server entries attributed to 179 AI companies. It recorded 1,732 findings; 48.8% were rated High or Critical. Among the 77 Critical findings, 87% involved code or command injection.

Read the denominator carefully. That 48.8% describes recorded findings, not the share of all AI companies or production MCP deployments that are vulnerable. The dataset covers public repositories, packages, and hosted components; private MCP environments sat outside the analysis. For enterprise teams, the playbook is plain: inventory connections, limit permissions to the work required, and test how fast access can be revoked.

How should you use this without overreading it?

The research was external, without access to assessed systems, and Black Kite did not test exploitation. Botnet signals, at 6.5% of companies, and unusual network activity, at 44.3%, warrant investigation but don't prove compromise on their own. In a supplementary Forbes AI 50 cohort, 52% had critical-vulnerability findings and 28% had credentials in infostealer records — but larger footprints create more observation opportunities, so don't treat that as a safety ranking.

Black Kite sells third-party cyber-risk intelligence, so this is vendor-produced research with a stated methodology, not a census. The operational takeaway for practitioners: assess three things together — the supplier, its dependencies, and the access its product receives inside your environment. As AI tools gain the ability to act inside business systems, those relationships now deserve the same scrutiny as any critical supplier.