A comprehensive analysis of over 1,250 AI-related vulnerabilities reveals a stark disconnect between the number of security flaws being discovered and the actual threats posed by attackers in the wild. Security researchers at Expel examined exploit evidence across 50 different AI vendors and found that only 4.2% of AI CVEs (Common Vulnerabilities and Exposures) show confirmed signs of active exploitation by real attackers.

Why Are AI CVE Numbers Growing So Fast?

The vulnerability landscape for AI tools is expanding rapidly. Expel's threat intelligence team is currently monitoring more than 1,250 CVEs spanning 50 unique AI vendor product types, with new vulnerabilities being published daily. This explosive growth has created a perception problem: headlines about AI security threats often sound more alarming than the actual risk data suggests.

The research examined ten prominent AI tools and platforms to identify which vulnerabilities pose the greatest real-world danger. The list includes widely used open-source and commercial platforms such as Claude, Flowise, Gradio, Hugging Face, LangChain, Langflow, LiteLLM, Ollama, OpenClaw, and others. Each tool was evaluated based on vendor advisories, proof-of-concept exploits, EPSS scores (which measure the probability of exploitation within 30 days), and confirmed attacker activity.

What Makes a Vulnerability Actually Dangerous?

Not all published CVEs are created equal. Researchers identified several key factors that distinguish theoretical vulnerabilities from genuine threats. These include evidence of active exploitation in the wild, vendor security advisories confirming the flaw, publicly available proof-of-concept code demonstrating how to exploit the vulnerability, EPSS score fluctuations indicating increased risk, and inclusion on CISA's Known Exploited Vulnerabilities list.

The gap between CVE volume and actual exploitation is significant. While vulnerability scanning vendors like Tenable, Qualys, and Rapid7 have struggled to keep pace with publishing unique identifiers for each AI CVE, their coverage remains incomplete. Tenable and Rapid7 publicly post AI-specific vulnerabilities, while Qualys publishes CVE coverage daily but rarely provides public tracking identifiers. This fragmentation makes it harder for organizations to prioritize which flaws to patch first.

How to Prioritize AI Security Vulnerabilities at Your Organization

• Focus on Exploit Evidence: Prioritize patching vulnerabilities that have confirmed evidence of active exploitation, vendor advisories, or public proof-of-concept code rather than treating all CVEs equally.
• Monitor EPSS Scores: Track Exploit Prediction Scoring System scores to understand which vulnerabilities pose the highest probability of being exploited in the next 30 days, and allocate resources accordingly.
• Leverage Scanning Technology: Use vulnerability scanning tools from major vendors to identify which AI CVEs are present in your infrastructure, but verify that your chosen scanner has published unique identifiers for the specific AI tools you deploy.
• Apply Layered Controls: Implement defense-in-depth strategies such as mandatory approval workflows for sensitive operations, sandboxed execution environments, and context-aware analysis of potentially harmful instructions.

For organizations running Claude, for example, the most critical vulnerabilities involve command execution and data exfiltration risks in Claude Code, the agentic tooling layer used for executing shell commands and reading local files. Anthropic has mitigated prompt injection risks through mandatory approval for sensitive operations and sandboxed bash tools that isolate filesystem and network access. Enterprise users should enforce managed policy files that lock deny-rules at the system level, restricting destructive commands and credential paths.

The research underscores an important principle for security teams: traditional exploitation risk factors remain relevant even in the AI era. Practitioners have an opportunity to leverage existing vulnerability management tools and processes to identify and remediate AI-specific CVEs effectively, rather than treating AI vulnerabilities as an entirely new category requiring separate handling.

As the AI tool ecosystem continues to mature, the gap between published vulnerabilities and actual exploitation risk may narrow. However, the current data suggests that organizations should focus their limited security resources on the small percentage of AI CVEs with confirmed evidence of real-world attacks, rather than attempting to patch every published flaw immediately.