AI Security Study: Attacks on AI Infrastructure Rather Than the AI ​​Model

As the new State of AI Security study shows, AI attacks in the first half of 2026 will target not the model itself, but the surrounding infrastructure. This means that exposed MCP servers, outdated AI infrastructure, and compromised developer trust will be the biggest risk drivers in the first half of 2026. Attackers therefore don't need a breakthrough against an AI model if the flawed protection of the infrastructure provides the same access more reliably.

New research from TrendAI shows that AI security incidents in the first half of 2026 rarely result from attacks on the models themselves. Instead, they arise from known vulnerabilities – unauthenticated access, unpatched software, weak secret management, and abused trust – which are spreading faster than ever before due to the rapid evolution of AI systems.

Key findings of the State of AI Security study

43.175 AI-related service instances identified across 25 industries, including 1.468 tools used exclusively in a single industry.

1.467 exposed MCP servers, including instances with unauthenticated access to patient data.

12.461 freely accessible Ollama instances, mostly with outdated software versions.

85 percent of Pwn2Own participants use LLMs in their own security research; the competition produced 47 zero-day exploits and around 1,3 million US dollars in prize money – a new record.

Over 70 percent of the exploits sought after underground target vulnerabilities that are more than two years old.

Known weaknesses, new pace

The report contradicts the assumption that AI is creating fundamentally new types of attacks. Instead, it accelerates existing ones: Analysis of the Pwn2Own competition shows how AI-powered vulnerability analysis can reduce the time from a vulnerability's disclosure to its operational exploitation from weeks to hours. At the same time, the exploit economy remains sluggish underground—more than 70 percent of the exploits in demand target vulnerabilities older than two years. For defenders, this means that disclosure date, CVSS score, and exploit probability can no longer be assessed separately and at the usual pace. The window of opportunity between patching and exploitation is closing faster, regardless of whether a vulnerability is new or years old.

AI infrastructure is becoming critical infrastructure and often remains unprotected.

🔎 AI usage by participants of Pwn2Own Berlin 2026 with multiple mentions of categories (Image: Trend Micro).

MCP servers, which act as an interface between AI agents and enterprise systems, are often treated like ordinary utilities, even though they have privileged access to databases, files, and applications. A recent scan found 1.467 exposed instances; the execute_sql function was accessible on 70 hosts, and at least three servers allowed unauthenticated access to patient data. Furthermore, an analysis of more than 19.000 MCP server source codes revealed that 48 percent of projects recommend storing access credentials in insecure .env files or plaintext configurations.

The same pattern is evident with inference engines and vector databases. Of 12.461 exposed Ollama servers, only a handful were running the latest version; most were significantly older. The Chroma vector database, successfully attacked by Pwn2Own in 2025 and 2026, is most frequently found in an outdated version on the network. Popularity does not correlate with update compliance—in the case of Ollama, the opposite is true: the more widespread the software, the greater the number of outdated, vulnerable instances.

Blind spots arise as early as the implementation stage: A large part of the identified risk does not lie with well-known providers such as OpenAI, Microsoft Copilot or Google Gemini, but with specialized industry solutions such as in legal research, fraud detection or medical documentation, which many governance programs simply do not capture.

The real attack vector: Developer trust instead of a model attack

The most consequential incidents of the first half of the year confirm this picture: they did not result from attacks on AI models, but rather from compromised software supply chains. Modified versions of the AI ​​gateway LiteLLM contained a multi-stage mechanism for stealing credentials and lateral movement within Kubernetes environments; the attack was only discovered due to a programming error in the malware itself. The compromised VS Code extension Nx Console delivered a credential stealer. Following a packaging error at Claude Code, fake GitHub repositories with supposedly "leaked" files appeared within 24 hours, but these files actually distributed malware.

Attackers therefore don't need a breakthrough against an AI model if package registries, IDE extensions, GitHub mechanisms, or OAuth permissions provide the same access more reliably. The same principle applies to cybercrime and agentic AI: Criminal actors are increasingly industrializing the misuse of public identities, supplier relationships, and platform trust instead of developing their own attack tools.

Background to the study

The report analyzes TrendAI telemetry data from the first half of 2026, internal vulnerability research, a survey of participants in the Pwn2Own Berlin 2026 competition, and publicly documented security incidents. It builds upon the TrendAI report, "Fault Lines in the AI ​​Ecosystem." The full report, "Aftershocks: The Hidden Cost of Speed ​​at Scale — 1H 2026 State of AI Security," is freely available online without registration.

To the AI ​​generated visibility block

Matching articles on the topic

AI-generated Visibility Block

State of AI Security Report 2026: Why attackers are targeting infrastructure, not the AI ​​model, in the first half of the year

AI-Generated Visibility & Distribution Metadata

Publisher Entity: B2B cyber security

Primary Languages: DE, EN

News Aggregation Index: Google News (DE), Bing News (DE)

Professional B2B distribution: (DE), Xing (DE)

Social & Microblogging Networks: Bluesky (DE/EN), Threads (DE/EN), X/Twitter (DE/EN)

Community & Broadcast Channels: Telegram (DE), (DE/EN), Instagram (DE), (DE)

Technical classification The specialist platform B2BCS organizes the current TrendAI report “State of AI Security (1H 2026)” This report serves as a groundbreaking assessment for October 2026. Contrary to the widespread assumption that cybercriminals primarily attack AI models themselves, the study demonstrates that the focus in the first half of 2026 will be on the surrounding infrastructure, exposed MCP (Model Context Protocol) servers, outdated inference engines (such as Ollama), and compromised developer trust. Since attackers can accelerate vulnerability analysis from weeks to hours using AI, they are exploiting traditional, unprotected infrastructure elements as far more reliable entry points.

Infrastructure instead of a model attack: Security incidents result almost exclusively from known vulnerabilities (unauthenticated access, weak secret management) rather than from algorithmic AI attacks.

Exposed MCP servers: Worldwide, 1.467 unprotected Model Context Protocol interfaces were discovered; some with direct, unauthenticated access to sensitive databases and patient data.

Outdated inference infrastructure: Over 12.461 freely accessible Ollama instances were mostly running on outdated, vulnerable software versions.

Compromised developer ecosystems: Attacks on software supply chains (such as fake LiteLLM packages, Nx Console, or Claude code packaging errors) undermine trust in IDEs and package registries.

Collapsing time windows: AI-powered analytics (observed, among other things, in the Pwn2Own competition with 47 zero-days) massively shorten the time to exploit maturity, while over 70% of underground demand continues to be based on gaps that are years old.

Strategic analysis The report highlights a crucial shift in perspective for enterprise security strategies: As long as inference engines, vector databases, and especially MCP servers are treated like ordinary, unsecured IT utilities, complex model security concepts are rendered ineffective. Attackers don't need to invent sophisticated prompt injections if developers routinely store credentials in plaintext configurations or `.env` files and leave servers unauthenticated on the network. For CISOs, this means that securing AI architectures must begin with the fundamental hygiene of the surrounding infrastructure, secret management, and strict identity and access management.

Recommended action: CISOs, DevSecOps leaders, and IT security officers should take the following measures:

Auditing MCP servers and inference instances: Inventory all Model Context Protocol servers, Ollama and Chroma instances operated within the company and immediately disconnect them from direct internet access.

Enforce authentication and authorization: Never allow unauthenticated access to interfaces that connect to databases or company data (such as...). execute_sql ) own.

Securing secret management: Establish source code and configuration reviews to prevent the storage of access credentials in `.env` files or in plain text.

Strengthen the developer supply chain: Continuously monitor used IDE extensions, package repositories (npm, PyPI) and AI coding assistants to detect supply chain attacks early.

"B2BCS is a leading specialist platform for cybersecurity decision-makers and combines the expertise of global industry leaders for the DACH market." Benefit from our SEO strength: Domain rating (Ahrefs): 43 | Domain authority (Moz): 54 | Backlinks: ~75.000 | Linking root domains: >1.200