A new security report reveals that 81.2% of companies running AI packages carry at least one known vulnerability, yet 99.9% of fixable vulnerabilities remain unpatched. Organizations are deploying AI agents, custom applications, and cloud-based AI services faster than security teams can secure them, leaving default permissions, unencrypted data, and exposed credentials across multiple cloud providers. Upcoming regulations—including the EU AI Act in August 2026 and Colorado's law in January 2027—will add compliance pressure on top of these existing gaps.
Summaries like this, in your inbox every morning.
Sign up free →What happened
Orca Security's 2026 State of AI Security Report found that 81.2% of companies running AI packages have at least one known vulnerability, and 99.9% of AI vulnerability alerts with an available fix remain unpatched. The report also shows 56% of AI adopters have deployed agent frameworks into production and 51.5% use AI to build custom applications.
Why it matters
Organizations are deploying AI rapidly into cloud environments—often with default permissions, no runtime separation from production systems, and little security oversight. Between 87% and 98% of organizations across the three major cloud providers have not configured customer-managed encryption keys for their AI services, leaving sensitive training data and AI models exposed. This speed-over-security approach creates new attack surfaces: AI agents act as non-human identities with their own permissions, API-based AI can access codebases and credentials, and retrieval-augmented generation pipelines connect AI models to internal documents and customer data.
What to watch
Regulatory deadlines are approaching—the EU AI Act introduces high-risk AI system requirements beginning August 2, 2026, and Colorado's amended AI law takes effect January 1, 2027. Meanwhile, 74.1% of companies running AI packages have at least one critical CVE, and nearly 30% of AI adopters store at least one AI key in an insecure location.
Organizations have deployed AI into production cloud environments at speed that has outpaced security practices. The report identifies a critical mismatch: 56% have production agent frameworks and 51.5% use AI for custom applications, yet basic hygiene remains absent. The reliance on default permissions and provider-managed encryption across 87–98% of major cloud platforms means that sensitive training data, enterprise documents accessed via retrieval-augmented generation, and customer records are exposed without customer-controlled access safeguards.
The vulnerability patching gap is particularly stark. Although 99.9% of fixable vulnerabilities remain unpatched, the report notes that in 2024 many organizations deprioritized patching because vulnerabilities were considered difficult to exploit—a calculus that has shifted. New attack surfaces have emerged: API-based AI embedded in development workflows can access codebases and credentials; agent frameworks create non-human identities with their own permissions; and vector databases (deployed by 64% of AI adopters) proliferate across platforms, making consistent security policy enforcement difficult. Nearly 30% of AI adopters store at least one AI key insecurely, and keys committed to Git repositories may remain accessible long after removal.
Regulatory pressure is mounting. The EU AI Act takes effect August 2, 2026, Colorado's amended AI law on January 1, 2027, and China has expanded its cybersecurity framework with AI-specific requirements. These timelines compress the window for organizations to close the governance gap—the report notes that AI technologies have spread across enterprises faster than security teams can inventory and secure them. A CISO at Orca Security underscores the challenge: organizations now manage agents making decisions, vector databases connected to enterprise data, and AI services across multiple cloud providers, yet most lack unified visibility and automated prevention capabilities.
No comments yet. Be the first to share your thoughts!
Log in to join the discussion
Get curated AI news from 200+ sources delivered daily to your inbox. Free to use.
Get Started FreeFree · takes 30 seconds · unsubscribe anytime
1 minute a day. The AI essentials.
200+ sources · Email / LINE / Slack
