Aftershocks: The Hidden Cost of Speed at Scale — 1H 2026 State of AI Security

Introduction

The first half of 2026 confirmed what security teams feared: AI didn't introduce a new category of threats but rather amplified the old ones.

In our 1H State of AI Security Report, 2026, we examined how AI adoption, exploitation, and defense evolved across the first six months of 2026. The headline finding is stark: familiar challenges are now playing out at machine speed. Unauthenticated exposure, unpatched software, weak secret management, and abused trust are accelerating inside faster-moving, more autonomous systems. The result is a compressed vulnerability lifecycle, exposed AI infrastructure at scale, and a criminal economy that's industrializing identity abuse faster than defenders can respond.

Our research surveyed 21.6 million URLs across 4.6 million unique hosts, identifying 43,175 AI-related service instances spanning 25 industries. Within that dataset, we discovered 1,468 AI tools used exclusively by a single industry vertical—niche legal platforms, fraud-detection engines for financial services, and medical documentation tools that never appear in generic AI inventories or public adoption reports.

These vertical-specific tools operate outside mainstream AI governance frameworks. Security teams typically build policies around widely deployed, consumer-facing platforms. Specialized vertical tools fall through those gaps entirely, leaving industry-specific AI infrastructure largely ungoverned.

Pwn2Own Berlin 2026, hosted by TrendAI™ Zero Day Initiative™ (ZDI), produced 47 unique zero-days across AI targets, resulting in a record US$1.3 million in payouts. The event revealed a critical shift: 85% of contestants incorporated Large Language Models (LLMs) into their vulnerability discovery workflows, demonstrating that AI has become standard research infrastructure.

Yet this acceleration has created a strange paradox. AI-powered vulnerability analysis can compress the timeline from disclosure to weaponized exploitation from weeks to hours. But the underground exploit market tells a very different story: attackers are not racing to exploit new zero-days. Instead, over 70% of requested exploits target vulnerabilities that are more than 2 years old. Nearly 8% target flaws between 10 and 15 years old. The oldest request involved a vulnerability first disclosed in 2011, 15 years earlier.

This gap between discovery speed and exploitation patterns reveals a deeper problem: hundreds of thousands of systems remain exposed to years-old bugs. As of February 2026, Shodan reported more than 270,000 systems still vulnerable to SMBGhost, 88,652 vulnerable to Heartbleed, and more than 18,000 vulnerable to CVE-2025-53770 seven months after patches became available. In the AI era, this remediation debt becomes increasingly risky. Accelerated vulnerability discovery now meets an entrenched backlog of unpatched systems, and attackers can exploit that gap at scale.

Model Context Protocol (MCP) servers have emerged as a new class of exposed AI infrastructure. Organizations often treat these servers as simple plugins or add-ons for convenience and integration. In reality, they are privileged infrastructure, tool brokers that can query databases, read local files, and access enterprise applications directly. This misclassification creates a governance blind spot.

Our research identified 1,467 exposed MCP instances on the internet. Of those, 1,227 were still running deprecated Server-Sent Events (SSE) transport with no authentication whatsoever. The tool surface was also significant: execute_sql appeared on 70 hosts, Graphiti Agent Memory was present on 39 hosts, while 3 exposed servers had access to progress_note, a function for retrieving patient medical records. Note that these are not theoretical risks, but direct pathways to critical systems.

The problem deepens when examining how MCP servers are built. Analysis of over 19,000 MCP server repositories revealed that nearly half (48%) recommended storing secrets (API keys, database credentials, cloud tokens) in insecure .env files or plaintext JSON configuration.

A single server compromise doesn't stop at the server. Compromised credentials expose cloud accounts, which affects the organization's entire infrastructure. We estimate that 600 to 1,650 of those 19,000 repositories contain exploitable vulnerabilities. SQL injection, remote code execution, and authentication bypass are endemic across the ecosystem.

Far from being routine utilities, these servers are critical infrastructure being deployed and maintained like consumer software.

Inference engines such as Ollama, LocalAI, and Llama.cpp were designed for local, trusted environments running on a developer's machine, isolated from the internet. Yet thousands are deployed to the open internet with no authentication, running versions that are months or even years outdated.

The update patterns we observed across inference engines, including Ollama, reveal a broader challenge. The most common Ollama version we identified was 0.21, with only six servers running the latest version (as of writing). This reflects how development tools are typically updated in practice: slowly, incrementally, and often years behind available releases. Older versions contain known vulnerabilities. Exposed instances running outdated software present real risk.

Popularity does not necessarily improve patch discipline. In fact, the opposite often holds. The broader the deployment, the greater the number of outdated, vulnerable instances left online. Paradoxically, popularity creates an illusion of security that does not exist. Some of these exposed, compromised hosts were already being hijacked for cryptomining operations, their compute stolen, and their integrity compromised.

The risk is heightened with vector stores. Even a fully patched, but exposed and unauthenticated, vector store presents a persistent opportunity for data poisoning.

The most damaging incidents in 1H 2026 followed established attack patterns: poisoned packages, credential theft, fake releases, malicious agent skills, and OAuth fan-out attacks. Rather than novel techniques like jailbreaks or adversarial attacks, attackers exploited developer trust.

The LiteLLM compromise illustrates this point. Two malicious versions (1.82.7, 1.82.8) were uploaded to PyPI, the official Python package repository. LiteLLM is widely used as an AI proxy, a bridge between developers, model providers, and production infrastructure. The malicious versions transformed it into a credential harvester, silently exfiltrating over 50 types of sensitive data, including SSH keys, cloud credentials, Kubernetes configs, API keys, and database passwords. The compromise could have remained undetected indefinitely. It was only discovered when a bug in the malware caused systems to crash—an accidental alert.

Other observed campaigns followed the same pattern:

• TeamPCP poisoned Xinference on PyPI within days
• Attackers used SEO poisoning to rank malicious download sites above official pages for Google Gemini CLI and Claude Code
• Compromised editor extensions (Nx Console) delivered credential stealers
• Fake GitHub releases packaged malware with Claude Code branding

These attacks exploited the same vulnerability, official-looking distribution channels that developers trust.

The developer ecosystem includes many distribution points, such as libraries, SDKs, GitHub Actions, IDE extensions, agent skills, and deployment platforms. A compromise at any point spreads across connected systems. Credentials stored in deployment platforms are particularly vulnerable. When a deployment platform is compromised, every connected system, including cloud accounts, databases, and APIs, is exposed. One platform breach then becomes an organizational breach.

Agentic systems take autonomous action; making API calls, executing code, modifying files, accessing systems, and persisting state across sessions. A compromised agentic system with persistent memory and delegated permissions becomes a long-lived attack platform. Attackers can use AI to automate identity abuse such as profiling, creating deepfakes, and launching social engineering attacks.

This creates an imbalance as attackers automate operations using AI while defenders respond manually, patching and investigating at human speed. When AI becomes embedded in critical workflows, familiar security flaws are amplified by speed and scale.

Implications for Defenders, CISOs, and Developers

Defenders must: Treat AI infrastructure, models, and agents as privileged systems. Inventory, authenticate, patch, monitor, and govern them as critical assets.

CISOs must: Account for niche AI tools in vendor risk frameworks and security governance. Extend supply-chain controls beyond code to include developer trust, credentials, and deployment platforms.

Developers must: Protect workstations and credentials as high-value assets. Implement secret management, verify software provenance, and govern generated code with rigor.