Open-source AI tools have become the default starting point for companies that want to run their own models, build an internal chatbot, or connect AI to their own documents. Most of them install in minutes. We wanted to know what security risk comes with them, so we counted.
What we looked at
We pulled every security advisory GitHub has reviewed for 17 widely used open-source AI tools, published from January 2023 through October 28, 2026. The list covers interfaces for chatting with models (Open WebUI), servers for running them (Ollama, vLLM, SGLang), frameworks for connecting them to data (LangChain, LlamaIndex, Haystack), visual workflow builders (Flowise, Langflow), and the infrastructure around them (LiteLLM, MLflow, Ray, BentoML, and others).
That came to 737 advisories. Each one includes a publication date, a severity rating, and the type of weakness involved.
What we found
Reported flaws nearly tripled in 2026. There were 156 advisories across these tools in all of 2025 and 423 from January through October 28, 2026.
Critical flaws often mean full control of the server. 133 advisories were rated critical. 72 of those allow an attacker to run their own code on the machine running the tool. These servers commonly hold API keys, the documents the AI was given, and network access to internal systems.
Four tools account for most of the total. Open WebUI (161), Flowise (114), vLLM (89), and MLflow (86) make up 61% of all advisories. They are also among the most widely deployed tools on the list.
The weaknesses are familiar ones. The most common types were weak or missing access control (180 advisories), letting an attacker run code (147), and reading or writing files outside the intended scope (87). These are long-standing web application problems, not new AI-specific attacks.
How to read these numbers
An increase in reported flaws is not proof that the software got worse. More researchers are examining AI tools than a year ago, several projects published large batches of advisories at once (48 appeared on a single day in May 2026), and critical flaws made up a smaller share of the total in 2026 (13%) than in 2025 (20%). Published advisories are a sign of projects fixing problems in the open. They protect users only when someone acts on them.
What organizations should do
- Inventory them. Identify every AI tool running in the organization, including tools installed outside IT.
- Keep them off the public internet. Place them behind a VPN or require login. Some of these tools do not enable authentication by default.
- Patch on a schedule. Track each tool's GitHub security advisories or enable Dependabot alerts.
- Limit access. Give each tool only the data, credentials, and network access it needs.
- Review before installing. Apply the same security review used for any other software.
Data and method
The full dataset, with every advisory linked to its GitHub record, and the script that rebuilds it are published on GitHub. Flaw types are our grouping of GitHub's weakness (CWE) categories. The tool list excludes older machine-learning frameworks such as TensorFlow and PyTorch, whose large historical counts would distort the trend.