Orca Security Report: 99.9% of Fixable AI Vulnerabilities Remain Unpatched as AI Moves

Orca Security’s 2026 State of AI Security Report warns that AI is becoming operational infrastructure faster than defenses can keep up, with 99.9% of fixable AI vulnerabilities still left unpatched. The report examines how AI is being used across more than 1,200 production cloud environments, finding that AI adoption has moved beyond pilots into live applications, cloud services, and autonomous workflows. Orca says 56% of organizations have already deployed AI agents in production and 51% use AI to build custom applications. It also reports that 81% run vulnerable AI packages, while 50% of package vulnerabilities have publicly available exploits. Released in Portland, Oregon on July 13, the report highlights wider AI ecosystem interconnections. It notes that 64% run vector databases, 55% run four or more AI services simultaneously, and 87% to 98% lack customer-managed encryption across major cloud providers.