Vulnerability Reports Jump Sixfold Since Spring: What the Archive on AI Supply-Chain and Agentic Risk Shows About the New Exposure Baseline

Twenty-one major software vendors disclosed 606 critical-severity CVEs in July 2026, up from a pre-2026 monthly record of 84, according to Epoch AI data highlighted by a16z and reported by AI Socratic on September 5. Total high-and-critical disclosures across those vendors hit roughly 2,500 for the month. The vendor list includes Microsoft, Google, Apple, AWS and NVIDIA. AI Socratic ties the inflection point to April 2026, when Anthropic released its Claude Mythos Preview and Project Glasswing's AI-driven vulnerability hunting went live.

That number alone would be a headline. Read against six months of coverage on AI tooling, code repositories and agentic attackers, it looks less like a one-time spike and more like a new baseline that security teams have not yet built process around.

The backlog behind the number

NIST's scoring queue grew from roughly 13,000 unscored CVEs to more than 27,000 in eighteen months, a growth rate that forced the agency to halt scoring for most submissions, Aikido Security reported on September 10. Aikido's read is blunt: frontier models are finding vulnerabilities faster than human reviewers can validate them, let alone patch them.

The Verizon 2026 Data Breach Investigations Report, cited in that same Aikido analysis, found that only 26% of actively exploited vulnerabilities were fully remediated in 2025. Median patch time rose to 43 days. That figure predates the July spike. If disclosure volume has jumped sixfold since spring while remediation capacity has not moved, the gap between what gets found and what gets fixed is the story, not the raw count of CVEs.

LiteLLM: the shape of the new supply chain

The clearest illustration of concentrated AI-tooling exposure sits in the LiteLLM incidents from earlier this year, now reinforced by a September follow-up. On March 24, the threat actor TeamPCP published backdoored versions of the LiteLLM Python package — 1.82.7 and 1.82.8 — after stealing PyPI credentials through a compromised Trivy GitHub Action, Snyk reported the same day. The malicious build used a .pth startup hook to execute on Python initialization, harvesting environment variables and cloud credentials before anyone loaded the library on purpose.

LiteLLM confirmed the compromise directly. The backdoored versions were live for approximately 40 minutes on March 24, the maintainers said in their own security update, before the team shipped version 1.83.0 through a rebuilt CI/CD pipeline with isolated environments and stronger publishing gates.

40 minutes does not sound like much exposure until the download numbers arrive. LiteLLM's package pulls 95 million downloads a month, which Cycode's March 25 write-up called a "fat, credential-rich target" for supply chain actors. Cycode also noted the backdoored builds attempted lateral movement across Kubernetes clusters and installed persistent systemd backdoors — this was not a smash-and-grab credential theft, it was infrastructure staging. The same campaign had already hit Aqua Security's Trivy and Checkmarx's kics-github-action, meaning the March incident was a continuation, not an isolated event.

The exposure did not end with the patched package. Wiz researchers found on September 9 that 9.6% of 3,074 internet-facing LiteLLM instances still accepted the default master key "sk-1234" or required no authentication at all, months after the backdoor. Wiz also disclosed two new flaws in the same instances: CVE-2026-59822, an authentication bypass through the MCP endpoint, and CVE-2026-59821, a post-auth root-level remote code execution via custom code guardrails. Both allowed silent exfiltration of cloud credentials through pass-through endpoints. A patched package and an unpatched, misconfigured fleet are two different problems, and the second one is still open six months later.

Agentic attackers are compressing the timeline that defenses assume

Separate from the disclosure spike, a run of reporting this year has documented attackers using AI agents to collapse the operational timeline that most detection architectures are built around. A mid-2025 incident report reviewed by VECTOR Labs on September 4 described a threat actor completing reconnaissance and data staging in ten hours using frontier AI — a sequence that typically takes human red teams two weeks. VECTOR Labs called this a "compression" of the attack timeline and framed it as the first documented agentic attack surface breach at scale, warning that enterprise architectures built for human-paced detection windows of hours or days are broken by that math.

TB Consulting's September 24 report on agentic penetration testing puts a number on the offensive side: AI agents can now autonomously crack Active Directory environments in under 15 minutes. TB Consulting's response is to argue for continuous, machine-speed testing rather than point-in-time manual assessments, which is a defensible conclusion given a 15-minute compromise window against an annual or quarterly pen test cadence.

DataDome's March 12 report adds the identity layer to this picture. The firm logged nearly 8 billion AI agent requests in early 2026, with a 2.4% impersonation rate for trusted agents such as PerplexityBot. DataDome's term for the resulting gap is "delegated AI logins": attackers mimicking user-sanctioned automation to abuse credentials in ways that look, to a traditional detection stack, like authorized agent traffic. Distinguishing a legitimate agent session from mid-session hijacking is a problem most identity tooling was not built to solve.

What practitioners are actually being told to do

Two pieces of guidance in the archive address this directly, and they converge on the same idea from different angles.

Akto's December 27 guidance recommends treating AI agents as first-class identities with unique credentials and tightly scoped permissions, rather than folding them into existing service-account or human-user models. Akto also pushes "decision provenance" — logging why an agent took a specific action — and maintaining an AI Asset Register that documents every agent's purpose and data access level. Without that register, an organization running dozens of agents has no inventory to check against a breach report.

Three takeaways follow from the coverage above:

• Audit LiteLLM deployments for default credentials now. Wiz's September finding that nearly one in ten internet-facing instances still runs with no authentication or the default "sk-1234" key means the March backdoor incident is not closed just because the package was patched. Check exposed instances against CVE-2026-59822 and CVE-2026-59821 directly.
• Assume patch backlogs will grow, not shrink. With NIST's scoring queue at over 27,000 and median remediation already running 43 days per the 2026 Verizon DBIR, teams should prioritize exploited-in-the-wild status over CVSS score alone when triaging the current volume of disclosures.
• Build an inventory of agent identities before an incident forces one. Akto's Asset Register recommendation and DataDome's delegated-login finding point to the same operational gap: most organizations cannot currently say which agents have which credentials, which makes post-incident scoping slower than the ten-hour compromise timeline VECTOR Labs documented.

None of this resolves the volume problem at its source. The disclosure count reflects AI systems finding bugs faster than humans can score or fix them, and that dynamic shows no sign of reversing in the data reported so far.

Links Verified at Time of Publish.

Sources

This article was reported from the following sources.

1. Critical CVE disclosures at 21 major vendors jump from 84 a month to 606 — AI Socratic, 2026-09-05
2. How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM — Snyk, 2026-03-24
3. Breaking LiteLLM: From Auth Bypass to Cloud Compromise — Wiz Blog, 2026-09-09
4. First Agentic AI Breach: Enterprise Security Gaps — VECTOR Labs, 2026-09-04
5. LiteLLM Supply Chain Attack: How to Respond — Cycode, 2026-03-25
6. The CVE spike across major software companies is a remediation problem — Aikido Security, 2026-09-10
7. The Rise of Agentic Fraud: How AI Agents Are Reshaping Security — DataDome, 2026-03-12
8. Agentic AI Security: Identify, Test & Defend AI Agents — Akto, 2025-12-27
9. Agentic Penetration Testing — TB Consulting, 2026-09-24
10. Security Update: Suspected Supply Chain Incident — LiteLLM, 2026-03-24