Black Kite finds cyber gaps across 18,160 AI suppliers

By Nathan Brooks

Black Kite’s external assessment of 18,160 AI companies found that 34.2% had at least one critical, externally observed unpatched vulnerability, while 61.7% had email-authentication weaknesses. The findings turn AI procurement into a review of supplier infrastructure, software components and integration permissions, not merely product capability.

Black Kite’s 2026 AI Supply Chain Report says AI purchasing creates exposure to supplier infrastructure, components and integration permissions. As tools gain the ability to act inside business systems, employers should require evidence on patching, credential protection, dependencies and access revocation. HR, procurement, IT and security teams should apply that scrutiny to AI relationships.

What did the 18,160-company review find?

Black Kite built the study population from a commercial company database. It checked business descriptions and public websites to confirm that AI was central to each company’s products or services. Company-level security observations came from September and October 2026.

The assessment found:

• 34.2% had at least one externally observed critical unpatched vulnerability.
• 9.8% had a vulnerability listed in CISA’s Known Exploited Vulnerabilities catalog.
• 61.7% had DMARC weaknesses; DKIM and SPF weaknesses appeared at 37.3% and 11.2%, respectively.
• 29.7% reached or exceeded 0.4 on Black Kite’s Ransomware Susceptibility Index, its critical threshold.
• 6.8% had associated corporate login information in records collected by information-stealing malware.

These measures answer different questions. A KEV-listed flaw has documented exploitation somewhere in the world; its presence does not establish that this supplier was attacked. The ransomware score prioritizes review; it does not estimate a company’s probability of suffering ransomware.

The three email-authentication rates overlap and should not be added together. Weak enforcement can make domain impersonation easier even when the AI product remains technically sophisticated.

“The AI supply chain isn’t failing in exotic ways. It’s failing in ordinary ones,” said Ferhat Dikbiyik, Black Kite’s chief research and intelligence officer. His diagnosis places patching, credential protection and integration access at the center of supplier reviews.

Which supplier roles showed more credential exposure?

Black Kite divided the ecosystem into six broad activity groups. Foundational technologies, including models, computing infrastructure and data services, made up about 10% of the population. Everyday business applications represented about 31%, while companies developing and implementing AI for other organizations accounted for roughly 23%.

That mix shows why focusing only on well-known model providers misses a substantial part of enterprise exposure. Integrators, cloud-service providers, data handlers and customer-service platforms can operate close to customer systems and information.

Credential findings were especially pronounced in those roles. Black Kite found associated corporate logins in infostealer records at 19.9% of cloud AI solution providers, compared with 4.1% of model and platform developers. Data and labeling companies stood at 13.9%, and customer-service platforms at 11.5%.

The finding does not show that every exposed login was used; the concern is what a still-valid credential can unlock, especially when it reaches customer-facing production rather than an unrelated business tool.

What do shared software dependencies mean?

Black Kite identified findings linked to n8n, Langflow or LiteLLM at 105 AI companies, tools that can sit between models, workflows and connected services. Several separately purchased AI services may rely on the same workflow platform, model router, library or cloud layer, so one flaw can require coordinated action across supplier relationships.

Can a supplier identify the affected component and the environments using it, then remediate or isolate it promptly? Customers also need to know which credentials and permissions it holds before it becomes a route into other systems.

How serious are the Model Context Protocol findings?

Black Kite separately examined 305 publicly discoverable Model Context Protocol server entries and attributed them to 179 AI companies. It recorded 1,732 findings, of which 48.8% carried High or Critical ratings. Among the 77 Critical findings, 87% involved code or command injection.

MCP gives AI applications a standardized interface to tools and data sources. Depending on implementation, a connected server can expose functions that read documents, query databases, update records or run other operations. Broad permissions can therefore extend risk beyond the AI application itself.

The denominator matters. The 48.8% figure describes recorded findings, not the share of all AI companies or production MCP deployments that researchers found vulnerable. The dataset covered public repositories, packages and hosted components; attribution did not establish live production use, and private MCP environments fell outside the analysis.

Employers should inventory connections, limit permissions to the work required and test how quickly access can be revoked. An external view of a supplier cannot reveal every permission a customer has granted inside its own environment.

What can this external research prove?

The study was external. Black Kite had no access to the assessed companies’ systems, generally matched observed software versions with disclosed vulnerabilities and did not test exploitation. Botnet-related signals appeared at 6.5% of companies, while unusual network activity appeared at 44.3%; both warrant investigation but do not independently prove compromise.

In Black Kite’s supplementary Forbes AI 50 cohort, 52% had critical-vulnerability findings and 28% had associated credentials in infostealer records. Larger digital footprints create more opportunities to observe problems, so those rates should not serve as a simple ranking of which company type is safest.

Black Kite sells third-party cyber-risk intelligence and monitoring, including supplier exposure analysis and ransomware-susceptibility indicators. Its report is vendor-produced research with a stated population and methodology, not a census of every AI company or evidence that all flagged systems have been breached.

Future AI vendor reviews should assess the supplier, its dependencies and the access its product receives together, using the report’s detailed findings and methodology.