Google GTIG: half of 2026 AI flaws hit agent orchestration
Google Threat Intelligence Group reports that agent orchestration frameworks now carry half of all disclosed AI software vulnerabilities.
· Google Threat Intelligence Group · Research by Robin Grunewald, Supriya Mazumdar, Kelli Vanderlee
Google Threat Intelligence Group tracked 2,076 vulnerabilities in AI software from January 2025 to August 2026, more than 1,500 of them in 2026, and says agent orchestration frameworks account for half of them.
01What happened
Google Threat Intelligence Group published a vulnerability trends report on September 30, 2026, written by Robin Grunewald, Supriya Mazumdar and Kelli Vanderlee. The report counts 2,076 AI-related CVE disclosures from January 2025 to August 2026, over 1,500 of them in 2026 alone. Across all software, monthly disclosures doubled in 2026, from 5,045 in January to 10,740 in August.
02How it works
GTIG groups AI software into categories and reports where the flaws land. Agent orchestration frameworks, including Flowise, Langflow, LangChain, Dify, LlamaIndex, AutoGen, CrewAI and MCP, hold 50% of AI-related flaws with 782 disclosures in 2026, a rise of 347%, mostly arbitrary code execution, command injection and server-side template injection. Inference and serving software such as vLLM, Ollama and LiteLLM had 212 disclosures in 2026, and 24% of those come from unauthenticated API endpoints or server-side request forgery.
03Who is affected
Teams running agent orchestration frameworks, inference servers and AI gateways in production. GTIG says zero-day exploitation of AI infrastructure has not yet been observed and only a handful of the 2,076 disclosures have confirmed exploitation in the wild, naming CVE-2026-42271 in BerriAI LiteLLM, CVE-2026-5027 in Langflow and CVE-2025-3248 in Langflow.
04What to do
GTIG recommends moving from unprioritized mass-patching to threat-intelligence-driven triage, sandboxing autonomous agentic workloads, and running AI-enhanced code review before shipping. Inventory the orchestration and inference components you expose, and check whether their API endpoints require authentication.
Sources 3 links, all fetched
- 1cloud.google.comGTIG Trends Report
- 2cloud.google.comGTIG Risk Ratings
- 3hacktron.aiHacktron CVE Report