TL;DR · 30-second read

The Short Version

A security firm called Black Kite checked more than 18,000 companies that make or sell artificial intelligence tools, looking only at what anyone on the internet can see. About one in three had a serious, publicly known software flaw left unfixed. Nearly two in three had weak protection against fake emails sent in their name.

The surprise: the riskiest group was not the famous model builders. It was the companies hired to run these tools for other businesses. Their work logins turned up in stolen-data dumps nearly five times as often.

Those helpers often hold keys to their customers’ systems.

Black Kite, a Boston-based third-party cyber risk intelligence firm, released its 2026 AI Supply Chain Report: The Risks Behind Your AI Relationships on November 10, 2026. Black Kite reported that, across 18,160 AI companies worldwide, 34.2% had critical unpatched vulnerabilities, 61.7% had weaknesses in DMARC email authentication, and 29.7% scored at or above its threshold for critical ransomware susceptibility.

The report also found corporate login credentials in infostealer records at 19.9% of cloud AI solution providers, compared with 4.1% of model and platform developers, and catalogued 1,732 security findings in publicly discoverable Model Context Protocol (MCP) components that connect AI applications to business systems.

Executive Summary

The headline numbers describe an AI supplier base that struggles with basic security hygiene: patching known flaws, locking down email domains against impersonation, and keeping employee logins out of criminal marketplaces. Nearly one in ten companies assessed (9.8%) ran software with a flaw on the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, meaning attackers have already used that flaw in real attacks.

The more useful finding for enterprise buyers is where the exposure concentrates. Credential leakage is highest among the vendors that implement and operate AI for customers, the category that typically receives access to cloud accounts, development environments and production data, and lowest among the model developers that dominate public attention. That shifts the practical question for security teams from which model to trust to which integrator holds the keys.

All findings are externally observed signals rather than confirmed breaches, and Black Kite says so explicitly. The data is best read as a map of where to look, not a tally of compromised companies.

Risk Concentrates Where Customer Access Does

The report’s most consequential comparison is credential exposure by supplier type. Infostealers are malware that harvest saved passwords and session tokens from infected computers, and the stolen logs are traded among criminals. Black Kite found corporate logins in those records at 19.9% of cloud AI solution providers, 13.9% of data and labeling companies, 11.5% of AI customer service platforms, and just 4.1% of model and platform developers. The firms at the top of that list are, by the nature of their work, granted access to customers’ cloud tenants, data pipelines and enterprise applications.

That matters because of who enterprises actually sign contracts with. Black Kite classifies 31% of AI suppliers as building AI applications for business operations and 23% as building and implementing AI solutions for other organizations, against 10% providing foundational models, compute and data services. Most procurement and security review effort tends to follow the high-profile model providers, but the larger and, on this measure, leakier population is the application and implementation layer that sits between those models and the customer’s systems.

The mechanism is straightforward: a stolen login at a vendor with standing access to a customer’s cloud environment is, if still valid, a credential into that customer. Black Kite does not report what share of the leaked credentials remained active, so the ratio describes relative exposure rather than confirmed pathways. Even so, a nearly fivefold gap between implementers and model builders is a clear signal about where third-party reviews should be weighted.

Ordinary Failures With Larger Consequences

Dr. Ferhat Dikbiyik, Black Kite’s Chief Research & Intelligence Officer, framed the findings as the AI supply chain “failing in ordinary ones,” not exotic ways, and the data supports that framing. The email numbers are a good example. DMARC, DKIM and SPF are three DNS-based standards that let receiving mail servers verify a message really came from the domain it claims; weaknesses appeared at 61.7%, 37.3% and 11.2% of companies respectively. Weak DMARC in particular makes it easier to send convincing phishing or invoice-fraud email that appears to come from a trusted vendor.

The Forbes AI 50, a list of prominent private AI companies, fared worse on some measures: 52% had critical unpatched vulnerabilities, 26% had known exploited vulnerabilities and 28% had credentials in infostealer records. Black Kite itself notes that larger digital footprints produce more detectable findings, so the comparison should not be read as proof that well-known firms are less secure, only that prominence is no substitute for independent assessment.

The Plumbing Layer: Shared Components and Agent Connectors

For cloud and data center operators, the most operationally relevant section concerns shared software. Black Kite found 105 AI companies with findings tied to n8n, Langflow and LiteLLM, three widely used tools for orchestrating AI workflows and routing requests to models, which often store API keys and service credentials. The report points to the March 2026 LiteLLM supply chain compromise, in which malicious releases introduced credential-harvesting code into downstream environments, including that of AI data services provider Mercor. Separately, PHP versions affected by the newly disclosed PHP2Shell vulnerabilities appeared at 939 AI companies, or 5.2% of the sample.

Model Context Protocol components, which let AI agents call external tools and business systems, are the newest layer. Black Kite logged 1,732 findings in publicly discoverable MCP components; 48.8% were rated High or Critical, and 87% of the 77 Critical findings involved code or command injection, a class of flaw that can let an attacker run instructions on the host. As agents are given permission to act inside enterprise and cloud infrastructure, these connectors become privileged access points, and the findings suggest many are being deployed before they are hardened.

How to Weigh the Numbers

Every figure here comes from outside-in scanning, and some signals are explicitly preliminary: Black Kite describes unusual network activity at 44.3% of companies and botnet-related findings at 6.5% as warranting investigation, not confirming compromise. The 29.7% ransomware figure depends on Black Kite’s proprietary Ransomware Susceptibility Index and its chosen 0.4 cutoff, whose calibration is not described in the announcement.

It is also fair to note that Black Kite sells continuous third-party risk monitoring, and its recommendations, to monitor AI suppliers continuously, map shared dependencies and review access granted to AI integrations, align with that offering. That does not weaken the underlying observations, many of which, such as missing patches and unenforced DMARC, are directly verifiable by any buyer. It does mean the most defensible use of the report is as a checklist for questioning vendors rather than as a definitive risk score for the sector.

Background

Third-party cyber risk management is the practice of assessing the security of an organization’s suppliers, since attackers frequently reach a target through a less-protected vendor that holds legitimate access. Firms like Black Kite do this largely from the outside, scanning internet-facing systems, DNS records, breach and infostealer data and vulnerability databases to score suppliers without needing their cooperation.

The AI supplier ecosystem has grown into several layers: foundational providers of models, computing infrastructure and data services; application developers building AI into business software; and implementation firms that build and operate AI systems for clients. Black Kite’s report classifies suppliers into six categories, and estimates that application and implementation companies together make up more than half of the AI vendors enterprises contract with.

Sources

Source: Black Kite Research Reveals Widespread Security Gaps Across AI Supply Chain, Exposing Enterprises to Growing Third-Party Cyber Risk — Black Kite’s announcement of its 2026 AI Supply Chain Report covering 18,160 AI companies.