Security flaws in popular AI tools have nearly tripled (birdyfoot.com)

A recent analysis of security advisories for 17 widely used open-source AI tools has revealed a significant uptick in reported vulnerabilities, with the total nearly tripling from 2025 to 2026. The study found 737 advisories, indicating that critical flaws in these tools—many of which are instrumental for companies developing their own AI models and chatbots—pose serious risks. Notably, 133 of the advisories were rated critical, allowing potential attackers to gain full control of affected servers, which often store sensitive data like API keys and internal documents. Open WebUI, Flowise, vLLM, and MLflow were identified as the most problematic tools, making up over 60% of total advisories. This surge highlights increasing scrutiny of AI software security, attributed to more researchers examining these tools and the transparent sharing of findings. However, it does not necessarily indicate a decline in software quality, as many advisories stem from ongoing efforts to address known problems. The findings serve as a crucial reminder for organizations to conduct thorough security assessments of AI tools, emphasizing the importance of implementing protective measures such as limited access, regular patching, and secure installation practices to mitigate potential risks in their deployments.