AI Security Failures Threaten Corporate Supply Chains
New research highlights critical vulnerabilities within the rapidly expanding artificial intelligence supplier ecosystem.
1Widespread AI Security Weaknesses
A new report from Black Kite reveals systemic cybersecurity failures across the global AI supplier ecosystem. Researchers examined 18,160 companies, discovering that many providers struggle with basic security hygiene. These findings suggest that the rapid adoption of AI solutions is currently outpacing the implementation of necessary safety and protection protocols.
2Critical Vulnerabilities in AI Firms
The study identified failures to patch critical vulnerabilities, protect credentials, and authenticate users effectively. Notably, 44.3% of organizations exhibited unusual network activity, while 41.8% showed signs of botnet-related involvement. These technical lapses create significant entry points for attackers, potentially compromising the integrity of the entire digital supply chain for enterprise clients.
3Integration Risks and Attack Surfaces
Enterprises spent approximately $37 billion on AI in 2025, with 76% of solutions purchased from external vendors. Each integration of an AI component or open-source tool expands the corporate attack surface. When companies connect these automated systems to internal platforms, any existing security flaw in the supplier's code becomes an immediate liability.
4Model Context Protocol Dangers
Analysis of Model Context Protocol components, used to link AI apps to business systems, shows alarming results. Out of 1,732 logged security findings, 48.8% were rated as High or Critical. These vulnerabilities include dangerous code and command injection flaws, which could allow unauthorized actors to manipulate business infrastructure through the AI interface.
5Credential Theft and Data Exposure
AI suppliers often hold privileged access to customer data and developer environments. Research indicates that 19.9% of enterprise AI deployment firms have corporate login information appearing in infostealer records. If a supplier's credentials are stolen, the breach can easily cascade, exposing their enterprise customers to a wide range of sophisticated cyberattacks.
6Visibility and Monitoring Challenges
Effective risk management requires clear visibility into the digital supply chain, yet 33.2% of assessed AI companies maintain a limited digital footprint. This lack of transparency regarding domains, subdomains, and IP addresses makes it difficult for businesses to monitor their vendors. Without proper oversight, hidden dependencies remain a major security blind spot.
7Proactive Risk Management Strategies
Businesses must move beyond single point-in-time security assessments to ensure long-term protection. Frequent, continuous monitoring of AI suppliers is essential to reveal evolving threats. Companies should actively engage with vendors to understand their specific technologies and dependencies, prioritizing the remediation of ransomware-related exposures and vulnerabilities that are already being exploited.
8Evaluating AI Tool Viability
Before deploying new AI tools, organizations must audit integrations, access levels, and data reach. By weighing the potential risk against the reward, companies can decide if a tool is worth the exposure. If kept, permissions should be strictly limited to the minimum access required for the tool to perform its intended function.
Original article: ZDNET — AI Security Failures Threaten Corporate Supply Chains