The vendor reporting that 99.9% of AI vulnerabilities go unpatched rated the same class of packages 'low to medium risk' in its own 2024 report.

SAFETY ORCA SECURITY'S 2026 STATE OF AI SECURITY REPORT, AMPLIFIED BY AUGUST 2026 SECURITY-STATISTICS ROUNDUPS · CLAIMED 2026-07-0923/26

The vendor reporting that 99.9% of AI vulnerabilities go unpatched rated the same class of packages 'low to medium risk' in its own 2024 report.

Orca's telemetry is real and the hygiene warning is fair. But the 99.9% counts alerts at scan time, the report offers no non-AI baseline, and the baseline that exists elsewhere says nobody patches most of anything.

01THE CLAIM

"99.9% of AI vulnerability alerts with an available fix remain unpatched, and 81% of organizations running AI packages have a known vulnerability with an average CVSS of 8.79" [SOURCE ↗]

TRUE, BUT4 SOURCES · LIVE 2026-08-25

ORCA SECURITY TRACK RECORD1 CLAIM · 40/100 BS RATE →

99.9%AI VULN ALERTS WITH AN AVAILABLE FIX STILL OPEN AT SCAN TIME (ORCA, Q2 2026)

10%SHARE OF ALL ITS OPEN VULNS THE TYPICAL ORG FIXES IN A MONTH (CYENTIA/KENNA)

250xORCA'S OWN PUBLIC-EXPLOIT RATE JUMP, 0.2% IN 2024 TO 50.1% IN 2026, UNEXPLAINED IN THE REPORT

The vendor reporting that 99.9% of AI vulnerabilities go unpatched rated the same class of packages 'low to medium risk' in its own 2024 report.

02THE CHECK

THE CLAIM, recirculating through August 2026 security roundups from Orca's July report: 99.9% of AI vulnerability alerts with an available fix remain unpatched, 81% of orgs running AI packages have a known vulnerability, and average severity has climbed to CVSS 8.79. THE CHECK: the numbers are real Q2 2026 telemetry from 1,200+ Orca customers, but the 99.9% counts alerts, not vulnerabilities or systems, at a point in time, with no time window and no non-AI comparison anywhere in the report. Cyentia and Kenna's long-running remediation research found the typical org fixes about 10% of its open vulns in any given month, for everything, not just AI. And Orca's own 2024 report described the same package class as mostly low to medium risk. Real hygiene problem, engineered headline.

03SAY THIS IN THE MEETING · 📸 SCREENSHOT IT

"'99.9% compared to what?' The report never shows the non-AI patch rate from the same scanner. The industry baseline says orgs fix about 10% of everything per month. Show me the AI column next to the non-AI column, then we can talk about recklessness."

On July 9, 2026, Orca Security published its 2026 State of AI Security Report under the headline '99.9% of Fixable AI Vulnerabilities Remain Unpatched as AI Moves Into Production.' By mid-August the number had completed the standard circuit: press release, trade coverage, statistics roundups, Linked

🔒 THE FULL AUTOPSY · FREE WITH AN ACCOUNT

You just read the free check. Sign in free, a code by email, no passwords, and the rest unlocks: the evidence trail, the steelman and the rebuttal, all 4 sources with quotes and screenshots, and our on-record call.