OpenClaw, a popular AI project, had more than 200 CVEs registered against it in a single quarter. That was enough to rank it 12th among all projects by number of vulnerabilities discovered and published between April and June.
The figure comes from Kaspersky's quarterly exploits and vulnerabilities report for Q2 2026, written by Alexander Kolesnikov and published on Securelist. It is the first edition in which the company has broken out vulnerabilities in open-source AI agents and AI frameworks as a category of their own, and the reason is simple enough. There are now sufficient of them to count.
The CVE count is being written by machines
Kaspersky reports that the number of registered vulnerabilities reached an unprecedented level in Q2, drawing on the CVE database, Russia's BDU register and GitHub Advisory. Critical flaws, those scoring above 9.0, jumped sharply too. The company attributes the surge to AI on both sides of the ledger. AI tools are being pointed at large volumes of previously unexamined code and are finding real bugs in it, while AI development tools are producing code of uneven quality that then needs fixes of its own. Kaspersky's assessment is that the discovery rate will keep climbing.
Access control is the recurring weak spot
Sorted by CWE class, the largest category of AI tool vulnerability in every quarter since the start of 2025 has been "undetermined type", which says something about how fast these projects are being triaged. Behind that, Kaspersky groups the recurring problems into three: inadequate access control over critical system objects, improperly implemented authentication and authorization, and injections. That last one is a return rather than a novelty. Injection bugs had largely retreated to web applications before AI agents arrived and gave them somewhere new to live.
The report's worked examples show what that looks like in practice. CVE-2026-25253 in OpenClaw is a trust failure in the user interface: it accepts a gatewayUrl parameter passed in the URL, automatically opens a WebSocket connection to whatever address that parameter names, and sends an access token during the handshake without asking the user to confirm anything. An attacker who supplies the address collects the token, and what follows depends on what that token can reach. CVE-2026-41948 in the Dify AI platform lets an authenticated user craft a request that escapes their own tenant and reaches internal REST APIs never meant for them. CVE-2026-45386 in Open WebUI treated pinning and unpinning a message as a read operation and checked only view permission on the channel, so a user limited to reading could still change a message's pinned state.
Kaspersky's verdict on the class as a whole is blunt. Looking back over a year and a half of the AI boom, it assesses that AI tool developers are more focused on expanding functionality than on security.
A state group has already turned up
The report also singles out a vulnerability in Langflow, which it describes as one of the first cases of an APT group exploiting AI technology. Kaspersky does not detail that intrusion. Its advice to defenders goes beyond patching: organizations adopting agent and LLM automation should build deliberate procedures for how those systems handle credentials and sensitive data, because most of the technology is proprietary and carries blind spots nobody has mapped.
Some of the research is fabricated
One finding deserves separate attention. Several vulnerability write-ups for Microsoft Exchange and SharePoint circulated during the quarter that Kaspersky assesses were fake, AI-generated research. The articles and the accompanying exploit source code look fairly polished and describe problems sitting close to genuinely vulnerable mechanisms, but the problems do not exist. In some cases the fake research arrived bundled with completely unrelated malware. Kaspersky reads the aim as sabotage of attention, increasing the time it takes to detect the real vulnerabilities. We covered a genuine SharePoint exploit release earlier this month, and telling the two apart is now part of the job.
That sits alongside our earlier coverage of how little AI-generated malware actually reaches a victim. The pattern in both is the same. The volume of AI-produced security material, offensive and defensive, has outrun anybody's ability to check it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.