GTIG Finds Attackers Quickly Exploited an AI-Discovered BeyondTrust Flaw
Summary
GTIG found vulnerability disclosures doubled in 2026, while exploitation remained rare. Attackers exploited an AI-discovered BeyondTrust flaw within days and increasingly targeted AI orchestration and serving software.
Key points
- GTIG examined vulnerability disclosure and exploitation data from January 2025 through August 2026; monthly disclosures rose from 5,045 in January 2026 to 10,740 in August.
- Only 0.23% of vulnerabilities disclosed in 2026 were observed exploited in the wild, though GTIG recorded 141 exploited vulnerabilities through August, compared with 127 in all of 2025.
- Half of the vulnerabilities GTIG identified as likely AI-discovered led to remote code execution, compared with 26% of those found by other means.
- Attackers exploited unauthenticated command injection flaw CVE-2026-1731 in BeyondTrust products within four days of disclosure, using it for initial access, privilege escalation, data theft, and payload deployment.
- GTIG tracked 2,076 vulnerabilities in AI-related software; attackers targeted orchestration tools including Flowise and Langflow, and serving software including vLLM, Ollama, and LiteLLM.
- Compromised AI gateways can expose third-party API keys and private prompts containing personal information or proprietary code; GTIG recommends threat-intelligence-driven patch prioritization and targeted defenses.
Article Details
- Publisher
- Google Threat Intelligence Group (GTIG)
- Report Period
- 2025-01 to 2026-08
- Scope
- Vulnerability disclosures and exploitation, including vulnerabilities in AI-related software.
- Sample Size
- GTIG tracked 2,076 vulnerabilities in AI-related software from January 2025 to August 2026.
- Key Statistics
- Monthly CVE disclosures rose from 5,045 in January 2026 to 10,740 in August 2026.
- GTIG observed 141 exploited vulnerabilities from January through August 2026, compared with 127 in all of 2025.
- Only 0.23% of vulnerabilities disclosed in 2026 were observed exploited in the wild.
- Half of vulnerabilities GTIG identified as likely discovered by AI led to remote code execution, compared with 26% of vulnerabilities found by other means.
- Of 2,076 vulnerabilities tracked in AI-related software from January 2025 to August 2026, more than 1,500 were disclosed in 2026.
- Recommendations
- Transition from unprioritized mass-patching to threat-intelligence-driven triage.
- Combine targeted edge defense with automated, agentic remediation.
CVE
CVE-2025-3248that leads to host takeover and API credential theft, and two Langflow flaws (CVE-2026-5027 and CVE-2025-3248) that let attackers write files to the host or run code remotely.CVE-2026-1731Attackers exploited CVE-2026-1731 within days of disclosure and used it to deploy payloads and steal data.CVE-2026-42271They include a command injection flaw in LiteLLM (CVE-2026-42271) that leads to host takeover and API credential theft, and two Langflow flaws (CVE-2026-5027 and CVE-2025-3248) that let attackers write files to the hostCVE-2026-5027(CVE-2026-42271) that leads to host takeover and API credential theft, and two Langflow flaws (CVE-2026-5027 and CVE-2025-3248) that let attackers write files to the host or run code remotely.
Malware
Vendors
Products
BeyondTrust Privileged Remote AccessThe report highlights rapid abuse of an AI-discovered issue in BeyondTrust Privileged Remote Access and Remote Support, along with growing targeting of AI software such as Flowise, Langflow, vLLM, Ollama, and LiteLLM.FlowiseThe report highlights rapid abuse of an AI-discovered issue in BeyondTrust Privileged Remote Access and Remote Support, along with growing targeting of AI software such as Flowise, Langflow, vLLM, Ollama, and LiteLLM.LangflowThe report highlights rapid abuse of an AI-discovered issue in BeyondTrust Privileged Remote Access and Remote Support, along with growing targeting of AI software such as Flowise, Langflow, vLLM, Ollama, and LiteLLM.LiteLLMThe report highlights rapid abuse of an AI-discovered issue in BeyondTrust Privileged Remote Access and Remote Support, along with growing targeting of AI software such as Flowise, Langflow, vLLM, Ollama, and LiteLLM.OllamaThe report highlights rapid abuse of an AI-discovered issue in BeyondTrust Privileged Remote Access and Remote Support, along with growing targeting of AI software such as Flowise, Langflow, vLLM, Ollama, and LiteLLM.vLLMThe report highlights rapid abuse of an AI-discovered issue in BeyondTrust Privileged Remote Access and Remote Support, along with growing targeting of AI software such as Flowise, Langflow, vLLM, Ollama, and LiteLLM.