Businesses integrating AI into their operations could be exposing themselves to additional cyber risks through weaknesses in their suppliers, according to new research from cyber risk intelligence company Black Kite.

Its 2026 AI Supply Chain Report assessed the external security of 18,160 AI companies worldwide, finding that 34.2% had at least one critical unpatched vulnerability. Almost one in ten (9.8%) had a vulnerability listed in the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalogue, indicating that the underlying flaw has been exploited in real-world attacks.

The research also identified weaknesses in basic security controls. More than three-fifths (61.7%) of the companies had weaknesses in DMARC email authentication, which can make it easier for attackers to impersonate legitimate company domains. Meanwhile, 29.7% recorded elevated exposure to conditions associated with ransomware attacks, based on Black Kite’s Ransomware Susceptibility Index.

The report also found unusual network activity at 44.3% of the companies assessed and botnet-related findings at 6.5%. Black Kite stressed that these are externally observed indicators requiring investigation, rather than confirmation that systems have been compromised.

Dr Ferhat Dikbiyik, chief research and intelligence officer at Black Kite, said: “The AI supply chain isn’t failing in exotic ways. It’s failing in ordinary ones. We’re seeing companies building incredibly sophisticated AI technologies while leaving critical vulnerabilities unpatched, failing to enforce basic email security, and exposing credentials that could provide access to sensitive systems.

“These are familiar security problems, but AI is dramatically changing their potential impact. As enterprises give AI suppliers greater access to their data, applications and infrastructure, they're also inheriting the security weaknesses of those suppliers.”

---