Black Kite finds critical unpatched vulnerabilities at 34% of 18,160 AI companies

Black Kite, which sells third-party cyber risk intelligence, says in its 2026 AI Supply Chain Report that 34.2% of 18,160 AI companies assessed had at least one critical unpatched vulnerability. The report also found that 9.8% had vulnerabilities in the US Cybersecurity and Infrastructure Security Agency's catalog of known exploited flaws.

Email authentication weaknesses affected 61.7% of the companies for DMARC, 37.3% for DKIM and 11.2% for SPF. Black Kite also found that 29.7% reached its threshold for critical ransomware susceptibility, while 44.3% showed unusual network activity and 6.5% had findings related to botnets.

Among companies on the Forbes AI 50 list, 52% had critical unpatched vulnerabilities and 26% had known exploited vulnerabilities. Corporate login information appeared in infostealer records for 19.9% of cloud AI solution providers, compared with 4.1% of model and platform developers.

The assessment identified 1,732 security findings in publicly discoverable Model Context Protocol components. Of those findings, 48.8% were rated high or critical, and 87% of the 77 critical findings involved code or command injection. Black Kite said its findings came from externally observed security conditions and did not necessarily indicate confirmed compromises.