Black Kite study finds widespread security gaps among 18,160 AI suppliers, expanding supply chain risk
A Black Kite study, the "2026 AI Supply Chain Report", assessed the external security posture of 18,160 AI companies worldwide and found that many suppliers fail basic controls. The research covers patching of critical flaws, credential protection, user and email authentication, and network security. About one in three assessed companies (34.2%) had at least one critical vulnerability, and 61.7% showed DMARC issues. Because AI suppliers often hold customer data, developer environments and enterprise access, a compromised supplier can expose its customers, so the report treats supplier monitoring as a core control. The article reports no specific exploited CVE and no single incident; the risk is a population-level exposure measure. (blackkite.com via the Reuters/PR Newswire release, kucoin.com)
Detalhes técnicos
- Email: 61.7% of AI companies had DMARC issues and 37.3% had DKIM weaknesses, both of which could enable impersonation and phishing.
- Ransomware: 29.7% of companies were rated highly susceptible to ransomware, according to Black Kite's susceptibility index.
- Network and botnet: unusual network activity was detected at 44.3% of organizations and botnet-related activity at 41.8%.
- Credentials: 19.9% of companies offering enterprise AI deployment solutions had corporate logins in infostealer records, and stolen corporate logins were linked to 6.8% of AI suppliers overall.
- MCP components: 48.8% of 1,732 logged security findings in AI firms' Model Context Protocol components were rated High or Critical, including code and command injection flaws.
- Visibility: 33.2% of assessed companies have a limited digital footprint, which hampers monitoring.
- Context named in the Black Kite release but not in the article: 939 AI companies (5.2%) run PHP versions affected by the PHP2Shell vulnerability, and the March 2026 LiteLLM supply chain compromise introduced credential-stealing code into downstream environments, including that of Mercor (kucoin.com). The article does not name a CVE for either.
Remediação
- Monitor AI suppliers continuously rather than relying on a single point-in-time assessment.
- Prioritize ransomware-related exposures and vulnerabilities known to be actively exploited.
- Audit each AI tool's integrations, components, access and reachable data, and assess the impact of its compromise.
- Where the tool is kept, limit its permissions and access to what it needs.
Linha do tempo
-
Black Kite study finds widespread security gaps among 18,160 AI suppliers, expanding supply chain risk
ler a análise desta fonte ocultar
A Black Kite study, the "2026 AI Supply Chain Report", assessed the external security posture of 18,160 AI companies worldwide and found that many suppliers fail basic controls. The research covers patching of critical flaws, credential protection, user and email authentication, and network security. About one in three assessed companies (34.2%) had at least one critical vulnerability, and 61.7% showed DMARC issues. Because AI suppliers often hold customer data, developer environments and enterprise access, a compromised supplier can expose its customers, so the report treats supplier monitoring as a core control. The article reports no specific exploited CVE and no single incident; the risk is a population-level exposure measure. (blackkite.com via the Reuters/PR Newswire release, kucoin.com)
Technical Details
- Email: 61.7% of AI companies had DMARC issues and 37.3% had DKIM weaknesses, both of which could enable impersonation and phishing.
- Ransomware: 29.7% of companies were rated highly susceptible to ransomware, according to Black Kite's susceptibility index.
- Network and botnet: unusual network activity was detected at 44.3% of organizations and botnet-related activity at 41.8%.
- Credentials: 19.9% of companies offering enterprise AI deployment solutions had corporate logins in infostealer records, and stolen corporate logins were linked to 6.8% of AI suppliers overall.
- MCP components: 48.8% of 1,732 logged security findings in AI firms' Model Context Protocol components were rated High or Critical, including code and command injection flaws.
- Visibility: 33.2% of assessed companies have a limited digital footprint, which hampers monitoring.
- Context named in the Black Kite release but not in the article: 939 AI companies (5.2%) run PHP versions affected by the PHP2Shell vulnerability, and the March 2026 LiteLLM supply chain compromise introduced credential-stealing code into downstream environments, including that of Mercor (kucoin.com). The article does not name a CVE for either.
Remediation
- Monitor AI suppliers continuously rather than relying on a single point-in-time assessment.
- Prioritize ransomware-related exposures and vulnerabilities known to be actively exploited.
- Audit each AI tool's integrations, components, access and reachable data, and assess the impact of its compromise.
- Where the tool is kept, limit its permissions and access to what it needs.