.jpg)
When security teams talk about AI risk, the conversation usually starts with prompt injection, jailbreaks, and guardrail evasion. Those threats are real. But the newest data from Cobalt pentests points somewhere less exotic: the flaws showing up most in AI systems are increasingly the same ones security teams have been fighting for decades, and most of the serious ones are still open.
That pattern showed up in a different corner of the AI stack, as Joe Brinkley, Director of Offensive Security Research and Community at Cobalt found when he audited ax-llm, the open-source runtime that AXERA-TECH uses to run language models on its edge AI chips.
AXERA-TECH's chips power devices such as smart cameras, driver-assistance systems, and industrial equipment. Joe's research found seven defects, including out-of-bounds writes, a stack buffer overflow, and OS command injection. After we reported the defects through coordinated disclosure, AXERA-TECH shipped fixes upstream, and the CVE records are scheduled to publish on October 31, 2026.
Read the full technical breakdown in Dissecting the ax-llm CVEs: Why Edge AI Memory and Execution Boundaries Matter.
None of those seven vulns is unique to AI. They are classic C and C++ memory-safety and input-handling failures, sitting in the code that runs the model. Cobalt's research also underscores a classic software supply chain problem: a fix in an upstream repository does not reach devices in the field until vendors ship it in firmware and device owners install it.
Cobalt pentest data covers a different layer. It comes from tests of AI and LLM applications, not edge hardware or firmware, so it doesn't measure the risk Joe found. It does show a related pattern, and the infographic below summarizes it in three findings.
1. The flaws are familiar. The LLM-specific share of AI/LLM pentest findings fell from 84.5% to 59.9% (down 24.7 percentage points), while conventional and unclassified findings grew 320% by volume.
2. Most serious findings stay open. Only 38.4% of high-risk AI/LLM findings get resolved, so nearly two stay open for every one that gets fixed.
3. Vendor software often ships unverified. 86.2% of surveyed organizations have deployed vendor software without requiring proof of security testing at least once, including 9.5% who do it frequently and 35.8% who do it sometimes.
AI security risks: what Cobalt pentest data shows
Finding 1: The flaws are familiar
LLM-specific flaws fell from 85% to 60% of AI/LLM pentest findings
Findings unique to AI still grew, but access control failures, misconfigurations, and other classic flaws grew much faster.
−24.7 pp
+9.1 pp
+5.3 pp
+8.6 pp
+1.6 pp
Change in the LLM-specific share of findings, from 84.5% to 59.9%. A change in share, in percentage points.
Growth in the number of conventional and unclassified findings, versus +15% growth for LLM-specific findings. A change in volume, in percent.
Source: Cobalt platform data, AI/LLM pentest findings, 2025 full year and 2026 through September 30. Shares sum to 100% within each year (±0.1 from rounding). "Other conventional categories" combines cross-site scripting, server-side injection, authentication and sessions, sensitive data exposure, authorization and privilege escalation, business logic, and one finding in a category outside the top 10.
Finding 2: Most serious findings stay open
Nearly 2 high-risk AI/LLM findings stay open for every 1 that gets fixed
Teams are fixing more than they were a year ago, but the open backlog is still the larger share. Each dot is 1% of high-risk AI/LLM findings; filled dots are resolved.
38.4% resolved, 61.6% open. 1.6 open for every 1 fixed.
21.1% resolved, 78.9% open. 3.7 open for every 1 fixed.
+17 days, or +89% growth. Median time to resolve (MTTR) counts only resolved findings, so it says nothing about the ones still open.
Sources: Cobalt State of Pentesting Report 2025. Cobalt State of Pentesting Report 2026. Cobalt AI and Pentesting Pulse Report 2026.
Finding 3: Trust without verification
86% of organizations have deployed vendor software without requiring proof of security testing
That includes almost 1 in 10 (9.5%) who do it frequently and more than a third (35.8%) who do it sometimes. Only 13.8% say they never have.
The question covers vendor software in general, not AI specifically. It matters for AI because models ship inside third-party runtimes, libraries, and firmware that buyers did not build and may never see tested.
Source: Cobalt State of Pentesting Report 2026 survey, n=455 security leaders and practitioners.
What this means for securing AI
The risk in AI systems is not only in the model. It is in the access controls, configurations, runtimes, and third-party code around it. That changes what good AI security testing looks like.
Test the whole stack, not just the prompts. Prompt-focused testing will miss the access control failures and misconfigurations that now make up a growing share of AI findings. Scope AI pentests to cover the application, APIs, and infrastructure the model runs on.
Measure fixes, not just findings. A finding only reduces risk once it is resolved. Track resolution rates for high-risk AI findings alongside time to fix, since median time to resolve counts only the findings that get closed.
Ask vendors for proof. Require evidence of security testing before deploying third-party AI software, and check that upstream fixes have reached the versions you actually run. Cobalt pentesters test AI and LLM applications against the OWASP Top 10 for LLM Applications and the conventional flaws around them.
Learn more about AI and LLM pentesting, or read the full State of Pentesting Report 2026 and AI and Pentesting Pulse Report.
About the data: Pentest figures come from Cobalt pentests of AI and LLM applications and are reported as percentages. Finding 1 compares 2025 (full year) with 2026 (through September 30). Finding 2 uses the State of Pentesting Reports 2025 and 2026, and the AI and Pentesting Pulse Report 2026. Finding 3 comes from the 2026 State of Pentesting survey of 455 security leaders and practitioners.
