Research
Security flaws in popular AI tools have nearly tripled — BirdyFoot Research
First reported · Discovered birdyfoot.com
Page published
Earliest dated coverage: 12 Nov 2026 · First observed: 13 Nov 2026 · Latest dated coverage: 12 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
BirdyFoot’s findings underscore the need to inventory, restrict access to, and patch self-hosted AI tools whose servers may expose API keys, documents, and internal network access.
BirdyFoot analyzed 737 GitHub-reviewed security advisories covering 17 open-source AI tools, finding 423 published through October 28, 2026, compared with 156 in all of 2025. Of 133 critical advisories since 2023, 72 involved attacker-controlled code execution. The study identifies mostly familiar application-security weaknesses and cautions that increased reporting does not prove the software became less secure.