Black Kite’s 2026 AI Supply Chain Report: The Risks Behind Your AI Relationships

Black Kite’s 2026 AI Supply Chain Report: The Risks Behind Your AI Relationships finds that the companies supplying advanced AI often carry familiar cybersecurity weaknesses. Its external assessment of 18,160 AI companies identified critical unpatched vulnerabilities at 34.2% of the organizations studied and email-authentication weaknesses at an even larger share.

The report’s central argument is that buying AI creates more than a software relationship. Customers also inherit exposure to the supplier’s infrastructure, the components behind its product, and the permissions its integrations receive. As AI tools gain the ability to act inside business systems, those relationships deserve the same scrutiny as other critical suppliers.

“The AI supply chain isn’t failing in exotic ways. It’s failing in ordinary ones,” said Ferhat Dikbiyik, Black Kite’s chief research and intelligence officer. The findings put patching, credential protection, and integration access at the center of the discussion.

Basic Security Gaps Across a Large AI Supplier Population

Black Kite built its study population from a commercial company database, then reviewed business descriptions and public websites to confirm that AI was central to each company’s products or services. Its company-level security observations draw on September and October 2026 data.

The assessment found:

• 34.2% had at least one externally observed critical unpatched vulnerability.
• 9.8% had a vulnerability listed in CISA’s Known Exploited Vulnerabilities catalog.
• 61.7% had DMARC weaknesses, while DKIM and SPF weaknesses appeared at 37.3% and 11.2%, respectively.
• 29.7% reached or exceeded 0.4 on Black Kite’s Ransomware Susceptibility Index, the company’s critical threshold.
• 6.8% had associated corporate login information in records collected by information-stealing malware.

These measures answer different questions. A KEV-listed flaw has a documented history of exploitation somewhere in the world; its presence does not establish that the supplier in this study was attacked. Likewise, a ransomware-susceptibility score is an indicator for prioritizing review, not the probability that a particular company will suffer ransomware.

Email authentication is relevant because AI suppliers still operate ordinary corporate domains and business processes. Missing or weak enforcement can make domain impersonation easier even when the AI product itself is technically sophisticated. The DMARC, DKIM, and SPF figures overlap and should not be added together.

Supplier Roles Matter More Than AI Branding

The report divides the ecosystem into six broad activity groups. Foundational technologies—including models, computing infrastructure, and data services—account for about 10% of the population. Everyday business applications represent about 31%, while companies developing and implementing AI for other organizations account for roughly 23%.

That helps explain why focusing only on well-known model providers misses a substantial part of enterprise exposure. Integrators, cloud-service providers, data handlers, and customer-service platforms can operate close to customers’ systems and information.

Credential findings were especially pronounced in those roles. Black Kite found associated corporate logins in infostealer records at 19.9% of cloud AI solution providers, compared with 4.1% of model and platform developers. Data and labeling companies stood at 13.9%, and customer-service platforms at 11.5%.

The concern is what those credentials could unlock if still valid, rather than an assumption that every exposed login has been used. Supplier reviews need to connect the finding to the service being purchased: a credential for an unrelated business tool and one with access to a customer-facing production environment can have very different consequences.

AI Suppliers Have Dependencies of Their Own

The report’s second layer examines the software components underneath AI products. Black Kite identified 105 AI companies with findings associated with n8n, Langflow, or LiteLLM—tools that can sit between models, workflows, and connected services.

A shared dependency can create concentration risk even when a vendor register appears diversified. Several separately purchased AI services may rely on the same workflow platform, model router, library, or cloud infrastructure. A security problem in that common layer can therefore require coordinated action across multiple supplier relationships.

The practical question is whether a supplier can identify the affected component, determine which environments use it, and remediate or isolate it promptly. Customers also need to understand which credentials and permissions the component holds, because software exposure becomes more consequential when it provides a route into other systems.

MCP Findings Highlight the Importance of Integration Permissions

Black Kite separately examined 305 publicly discoverable Model Context Protocol server entries attributed to 179 AI companies. Across those entries, it recorded 1,732 findings, of which 48.8% were rated High or Critical. Among the 77 Critical findings, 87% involved code or command injection.

MCP gives AI applications a standardized interface to tools and data sources. Depending on the implementation, a connected server can expose functions that read documents, query databases, update records, or run other operations. A vulnerable component with extensive permissions may therefore put more than the AI application itself at risk.

The denominator matters: 48.8% describes recorded findings, not the share of all AI companies or production MCP deployments that are vulnerable. The dataset covers publicly discoverable repositories, packages, and hosted components; domain attribution does not establish live production use, and private MCP environments were outside the analysis.

For enterprise teams, the implication is to inventory connections, limit permissions to the work required, and test how quickly access can be revoked. An external view of a supplier cannot reveal every permission that a customer has granted inside its own environment.

How to Use the Findings Without Overreading Them

The research was conducted externally, without access to the assessed companies’ systems. Critical-vulnerability findings generally match observed software versions with disclosed vulnerabilities; Black Kite did not test exploitation. Botnet-related signals, reported at 6.5% of companies, and unusual network activity, at 44.3%, warrant investigation but do not independently prove a compromise.

Visibility also affects comparisons. In a supplementary Forbes AI 50 cohort, 52% had critical-vulnerability findings and 28% had associated credentials in infostealer records. Larger digital footprints provide more opportunities to observe problems, so those figures should not be treated as a simple ranking of which type of company is safest.

Black Kite sells third-party cyber-risk intelligence and monitoring, including supplier exposure analysis and ransomware-susceptibility indicators. Its report is vendor-produced research with a stated population and methodology, rather than a census of every AI company or evidence that all flagged systems have been breached.

The strongest operational takeaway is to assess three connected things together: the supplier, its dependencies, and the access its product receives. The full 2026 AI Supply Chain Report: The Risks Behind Your AI Relationships provides Black Kite’s detailed findings and methodology for applying that approach to AI vendor reviews.