Orca’s 2026 AI Security Report Finds Widespread Unpatched Vulnerabilities and Exposed Credentials
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Orca’s analysis of over 1,200 production organizations found vulnerable AI packages at 81.2% of organizations using them, widespread insecure credential storage, and missing agent guardrails. The report urges patching, least privilege, and stronger governance.
Key points
- The report uses aggregated, anonymized telemetry collected in Q2 2026 from more than 1,200 production organizations using Orca’s cloud security platform.
- Orca found known AI-package vulnerabilities in 81.2% of organizations using AI packages, up from 62% in 2024; 74.1% had at least one critical CVE.
- Public exploits were available for 50.1% of AI vulnerability alerts, compared with 0.2% in 2024. Of 104,390 alerts with fixes available, 104,284 remained open.
- Among AI adopters, 29.5% stored at least one AI secret or key in an insecure location. Provider-specific rates included 40% of Anthropic SDK users and 28.4% of OpenAI users.
- Agent frameworks were deployed by 56.2% of AI adopters, while 57.1% of Bedrock-using organizations had not configured guardrails.
- Customer-managed encryption was absent at 98.4% of organizations using SageMaker notebooks and 94.8% using Vertex AI model storage; these workloads remained reliant on provider-managed encryption.
- Recommendations include patching high-severity dependencies, rotating exposed keys, hardening notebooks, inventorying agent permissions, and auditing vector database authentication and network exposure.
Article Details
- Publisher
- Orca Security
- Report Period
- Q2 2026
- Scope
- Aggregated, anonymized production-cloud telemetry covering AI configurations, package vulnerabilities, credentials, agents, RAG infrastructure, encryption, and workload identities.
- Sample Size
- Over 1,200 production organizations using Orca Security's cloud platform.
- Key Statistics
- 81.2% of organizations with AI packages had at least one known vulnerability, compared with 62% in the 2024 report; average CVSS increased from 6.9 to 8.79.
- 50.1% of AI package vulnerability alerts had a public exploit available, compared with 0.2% in the 2024 report; this does not establish active exploitation.
- 99.9% of AI vulnerability alerts with an available fix remained unpatched: 104,284 of 104,390 unique fixable alerts were open.
- 29.5% of AI adopters had at least one AI secret or key stored in an insecure location; provider populations overlapped.
- 57.1% of Bedrock-using organizations had not configured guardrails.
- Recommendations
- Patch high-severity AI packages with available fixes and include emerging AI dependencies in software inventories and patch SLAs.
- Immediately rotate exposed AI keys, move secrets into managed secret stores, and audit repository commit history.
- Enable production-agent guardrails, audit permissions to modify or bypass them, inventory agent identities, and enforce least privilege.
- Harden AI infrastructure by disabling notebook root access, enforcing IMDSv2, auditing network exposure and authentication, and configuring customer-managed encryption keys.
- Create a unified cross-cloud AI inventory and security baseline, monitor prompt injection and anomalous agent actions, and apply production-grade security requirements to training and experimentation environments.
MITRE ATT&CK
T1195.001 · Compromise Software Dependencies and Development ToolsThe report describes poisoned AI models and malicious packages distributed through model hubs and package registries to compromise downstream users.T1195.002 · Compromise Software Supply ChainAn unknown actor reportedly exploited Cline's issue-triage workflow to publish unauthorized cline@2.3.0, which installed OpenClaw on approximately 4,000 developer machines.T1552.001 · Credentials In FilesThe RoguePilot research demonstrated reading sensitive environment files through a symbolic link and exfiltrating a privileged GITHUB_TOKEN.T1574.002 · DLL Side-LoadingA fake Claude website reportedly distributed PlugX through DLL sideloading.
CVE
CVE-2021-34141| 2 | CVE-2021-34141 | numpy | 46.9% | 5.3 | MEDIUM |CVE-2024-5206| 3 | CVE-2024-5206 | scikit-learn | 32.9% | 5.3 | MEDIUM |CVE-2025-49596| 2025 MCP Inspector RCE (CVE-2025-49596)[^5] | AI tooling vulnerability | Remote code execution in core AI agent development tool |CVE-2026-25990| 1 | CVE-2026-25990 | Pillow | 72.8% | 8.9 | HIGH |
People
Threat Actors
Malware
Vendors
Amazon Web Servicestraining data, model artifacts, and pipeline outputs. Adoption nearly doubled from 45% in 2024, despite AWS randomizing the default convention. |Anthropic28.4% of OpenAI users store API keys in unsecure locations (40% for Anthropic SDK users), and 94% of Azure OpenAI deployments still rely on key-based auth instead of managed identities.Googleaccount names and republished poisoned versions of popular models under the original trusted namespace. Google responded by running daily orphan-scan checks for at-risk models. |Hugging FaceThis matters for the supply chain: when 60.8% of AI adopters pull artifacts from Hugging Face into production environments, the ML registry becomes as critical and as exposed as Node Package Manager (npm) or PythonMicrosoft[^1]: https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/OpenAI28.4% of OpenAI users store API keys in unsecure locations (40% for Anthropic SDK users), and 94% of Azure OpenAI deployments still rely on key-based auth instead of managed identities.Orca Security©2026 ORCA SECURITY. ALL RIGHTS RESERVED.
Products
Amazon Bedrock| of Bedrock organizations run agents without guardrails. | More than half of organizations using Amazon Bedrock have not configured any safety guardrails, leaving AI agents operating without content filtering,Azure OpenAI28.4% of OpenAI users store API keys in unsecure locations (40% for Anthropic SDK users), and 94% of Azure OpenAI deployments still rely on key-based auth instead of managed identities.Clineresearcher Adnan Khan publicly disclosed Clinejection, a prompt injection attack that weaponized the Cline coding assistant's own GitHub issue triage bot against its maintainers.Flowise| 2026 Flowise critical vulnerability[^3] | AI workflow tool exploitation | Thousands of AI deployments impacted |GitHub CodeSpacesTakeover*, which demonstrated a passive prompt injection chain achieving full repo takeover via GitHub Codespaces, and *AI-Induced Lateral Movement (AILM)*, which introduced the AI layer as a new pivot vector, aGitHub CopilotRecent publications include *RoguePilot: Exploiting GitHub Copilot for a Repository Takeover*, which demonstrated a passive prompt injection chain achieving full repo takeover via GitHub Codespaces, and *AI-InducedGrafanaprompt injection attack that bypasses Grafana's AI guardrails withoutSageMaker51.5% of organizations have adopted AI to build custom applications, yet 80% of SageMaker deployments still run with all five core insecure defaults enabled.Vertex AI| **98%** | of SageMaker notebook instances lack customer-managed encryption. | Azure OpenAI (91.6%) and Vertex AI Models (94.8%) follow close behind. While Vertex AI improved slightly since 2024, most organizationsVertex AI Agent EngineCloud's Vertex AI Agent Engine and Agent Development Kit. Excessive default movement, credential extraction, and silent data exfiltration through
Tools
Agent Governance ToolkitMicrosoft released the Agent Governance Toolkit (https://github.com/microsoft/agent-governance-toolkit/) in April 2026, an open-source runtime governance layer that claims to cover all ten items in the OWASP Agentic TopMCP Inspector| 2025 MCP Inspector RCE (CVE-2025-49596)[^5] | AI tooling vulnerability | Remote code execution in core AI agent development tool |Picklescan(Hugging Face)[^6] | Platform defense bypass | Malicious pickle-format models evaded Hugging Face's Picklescan by using 7z compression instead of the standard ZIP inside PyTorch format. Demonstrated that existing