# Google GTIG: half of 2026 AI flaws hit agent orchestration

> Google Threat Intelligence Group reports that agent orchestration frameworks now carry half of all disclosed AI software vulnerabilities.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research
- **Published by:** Google Threat Intelligence Group
- **Disclosed:** 2026-09-30
- **Affects:** Flowise, Langflow, LangChain, Dify, LlamaIndex, AutoGen, CrewAI, MCP, vLLM, Ollama, LiteLLM
- **Research by:** Robin Grunewald, Supriya Mazumdar, Kelli Vanderlee
- **Primary source:** https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era
- **Page:** https://theinjection.dev/items/gtig-ai-era-vulnerability-trends/

Google Threat Intelligence Group tracked 2,076 vulnerabilities in AI software from January 2025 to August 2026, more than 1,500 of them in 2026, and says agent orchestration frameworks account for half of them.

## What happened

Google Threat Intelligence Group published a vulnerability trends report on September 30, 2026, written by Robin Grunewald, Supriya Mazumdar and Kelli Vanderlee. The report counts 2,076 AI-related CVE disclosures from January 2025 to August 2026, over 1,500 of them in 2026 alone. Across all software, monthly disclosures doubled in 2026, from 5,045 in January to 10,740 in August.

## How it works

GTIG groups AI software into categories and reports where the flaws land. Agent orchestration frameworks, including Flowise, Langflow, LangChain, Dify, LlamaIndex, AutoGen, CrewAI and MCP, hold 50% of AI-related flaws with 782 disclosures in 2026, a rise of 347%, mostly arbitrary code execution, command injection and server-side template injection. Inference and serving software such as vLLM, Ollama and LiteLLM had 212 disclosures in 2026, and 24% of those come from unauthenticated API endpoints or server-side request forgery.

## Who is affected

Teams running agent orchestration frameworks, inference servers and AI gateways in production. GTIG says zero-day exploitation of AI infrastructure has not yet been observed and only a handful of the 2,076 disclosures have confirmed exploitation in the wild, naming CVE-2026-42271 in BerriAI LiteLLM, CVE-2026-5027 in Langflow and CVE-2025-3248 in Langflow.

## What to do

GTIG recommends moving from unprioritized mass-patching to threat-intelligence-driven triage, sandboxing autonomous agentic workloads, and running AI-enhanced code review before shipping. Inventory the orchestration and inference components you expose, and check whether their API endpoints require authentication.

## Quick facts

- **AI flaws tracked:** 2,076 from January 2025 to August 2026
- **2026 share:** Over 1,500 disclosed in 2026
- **Agent orchestration:** 50% of AI flaws, 782 in 2026, up 347%
- **Inference and serving:** 212 disclosures in 2026
- **AI-found flaws reaching RCE:** 50%, against 26% across all CVEs
- **Exploitation rate:** 0.23% of 2026 disclosures seen exploited
- **Published:** 2026-09-30

## Sources

1. [GTIG Trends Report](https://cloud.google.com/blog/topics/threat-intelligence/vulnerability-discovery-and-exploitation-trends-in-the-ai-era)
2. [GTIG Risk Ratings](https://cloud.google.com/blog/topics/threat-intelligence/separating-signal-noise-how-mandiant-intelligence-rates-vulnerabilities-intelligence)
3. [Hacktron CVE Report](https://www.hacktron.ai/blog/cve-2026-1731-beyondtrust-remote-support-rce)