99.9% of fixable AI vulnerabilities remain unpatched

Orca Security's 2026 State of AI Security Report warns that AI infrastructure has been rapidly deployed with weak security hygiene: 81.2% of companies running AI packages have at least one known vulnerability, 74.1% have at least one critical CVE, and 99.9% of AI vulnerability alerts with available fixes remain unpatched. The report highlights exposed attack surfaces—agent frameworks, RAG pipelines, vector databases, API keys, and misconfigured cloud AI services—recommending unified visibility, customer-managed encryption keys, governance controls, and automated prevention to reduce risk.