99.9 percent of fixable AI vulnerabilities are sitting unpatched in production
Telemetry from 1,200 production cloud estates: four in five AI stacks carry a known flaw, half of those flaws have public exploits, and agent frameworks are already in production at most adopters.
- 99.9 percent of AI-related vulnerabilities with an available fix remain unpatched in production cloud environments, per Orca Security's 2026 State of AI Security report, drawn from telemetry across more than 1,200 organizations.
- 81.2 percent of organizations running AI packages have at least one known vulnerability, and half of AI package flaws now have a publicly available exploit, a 250-fold increase over 2024 by Orca's count.
- The agent hook: 56 percent of AI adopters have agent frameworks in production, inheriting threats from packages, SDKs, and the expanding MCP ecosystem.
The AI stack has a patching problem that makes the traditional software backlog look diligent. Orca Security's 2026 State of AI Security report, built from anonymized telemetry across more than 1,200 production cloud organizations on AWS, Azure, and Google Cloud, finds 99.9 percent of AI-related vulnerabilities with an available fix remain unpatched in production. The report made the trade-press rounds Monday, led by Help Net Security.
The numbers, all from one telescope
All figures are Orca's own telemetry, so read them as one vendor's wide-angle view rather than independent findings. That view: 81.2 percent of organizations running AI packages carry at least one known vulnerability, up from 62 percent in the firm's 2024 report; 74.1 percent have at least one critical-severity CVE in the AI stack; and 50 percent of AI package vulnerabilities now have a publicly available exploit, which Orca calls a 250-fold increase over 2024. Around the models themselves, 64 percent of adopters have vector databases wired to internal documents, and nearly 30 percent store at least one AI key somewhere insecure.
Agents inherit all of it
The finding that belongs on this beat: 56 percent of AI adopters now run agent frameworks in production, and those agents inherit every threat in the stack beneath them, from packages and SDKs to the expanding MCP ecosystem the report flags by name. An unpatched CVE under a chatbot is a disclosure risk; the same CVE under an agent with tool access and credentials is an incident waiting for an operator, which is no longer hypothetical after CISA put a deadline on the Langflow flaw that an autonomous ransomware crew went on to exploit. Pair Orca's 99.9 percent with the attack surface documented in HalluSquatting and the gateway hijack wave, and the pattern is consistent: agent adoption is running years ahead of agent hygiene.