The biggest AI attack surface is the agent stack itself

Google's Threat Intelligence Group just published the first comprehensive count of the AI attack surface, and the headline number is less interesting than where the flaws live. Across January 2025 through August 2026, GTIG tracked 2,076 AI-related CVE disclosures. More than 1,500 of them landed in 2026 alone. Half of this year's disclosures sit in one layer: AI orchestration and agent frameworks.

That is Flowise, Langflow, LangChain, Dify, CrewAI, AutoGen, MCP tooling. The software that lets agents plan, call tools, and chain steps together. GTIG reports a 347% surge in disclosures for this layer in 2026. The exploit mechanism is almost poetic in its symmetry: attackers hit the dynamic code execution nodes these frameworks use to let agents interact with environments, via prompt injection or crafted workflow JSONs, and turn natural language prompts into unauthenticated remote code execution. The thing that makes the agent useful is the thing that makes it exploitable. Compromise the orchestrator and you inherit the whole tool chain.

The rest of the stack is not clean either. Inference and serving infrastructure (vLLM, Ollama, LiteLLM, Triton) drew 212 disclosures in 2026, and nearly a quarter of those come from unauthenticated API endpoints or server-side request forgery. That is a direct path past the perimeter firewall to your GPU cluster or your model checkpoints. Enterprise AI gateways are the worst of both worlds: at the application layer a compromised gateway exposes third-party API keys and private prompt streams containing PII or proprietary source code, and at the infrastructure layer it becomes a foothold for lateral movement into your cloud.

Now the part that should change your patch queue. Out of 2,076 disclosures, only a handful have been confirmed as exploited in the wild, and GTIG names them. CVE-2026-42271: command injection in LiteLLM's MCP server preview endpoints, leading to host takeover and API credential theft. CVE-2026-5027: path traversal file write in Langflow's file upload handler, letting attackers drop cron jobs or SSH keys onto the host. CVE-2025-3248: unauthenticated Python code injection through an exec() call in Langflow's code validation endpoint, which is about as bad as it sounds. If you run any of these exposed to the network, they are not theoretical.

The report's other finding is about speed. Disclosures doubled in 2026, from about 5,000 a month in January to over 10,700 in August. Exploitation is keeping pace: 141 distinct vulnerabilities exploited in the first eight months of 2026, already past the full-year 2025 total of 127. GTIG's read is that attackers are not mainly finding new zero-days. They are using AI tooling to automate the analysis of patches, disclosures, and proof-of-concept code, and weaponizing n-days faster than defenders patch them. The case study: CVE-2026-1731, an unauthenticated OS command injection in BeyondTrust's privileged remote access product, discovered autonomously by the Hacktron AI research agent. One threat cluster exploited it within four days of public disclosure. Five more followed within seven. Your patch window is now measured in days, and the other side has automation.

GTIG's own recommendation is the one to take seriously: stop mass-patching everything and move to threat-intelligence-driven triage, with targeted edge defense and automated remediation. Only 0.23% of disclosed vulnerabilities, roughly one in 431, were ever observed being exploited. The raw disclosure count is also inflated by automated CVE assignment; GTIG notes that Linux kernel descriptions alone generated about 5,000 CVEs in the window with zero exploited zero-days. Patch what attackers actually use. The report tells you exactly where that is: the orchestration layer, the inference endpoints, and the gateways holding your keys.

What remains unknown: whether the exploitation rate keeps climbing through Q4, and whether AI-discovered vulnerabilities keep skewing toward remote code execution (half of them do, against 26% for conventionally found flaws). GTIG has not yet observed zero-day exploitation of AI infrastructure itself. Yet is doing a lot of work in that sentence. Patch the orchestrator this week.