Research explained
TrendAI’s ecosystem report combines software exposure with malicious AI use
The vendor’s landscape analysis covers multiple kinds of risk; its aggregate CVE counts are not one incident or one affected product.
What happened
TrendAI’s March 2026 landscape report discusses vulnerabilities in AI-related software, exposed deployments, supply-chain weaknesses and attacker use of AI tools. These categories describe different failure modes and require different evidence.
The report’s vulnerability totals depend on how the vendor defines and collects “AI-related” cases. They should not be treated as a count of compromised organizations or a direct measurement of the probability that an individual model will fail.
Use the report to check coverage across your own stack: software maintenance, service exposure, dependency provenance and response monitoring. Prioritize concrete affected components and permissions rather than assigning one severity to the entire AI ecosystem.
Next step
Map report categories to actual components, exposures and controls in your deployment.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
TRE