I pulled every AI/agent-relevant CVE from CISA KEV and NVD over a month. The number that stopped me: 851. And RAG, not the model itself, is where most of them land.
Everyone in this space talks about prompt injection like it's the whole threat. The CVE data says otherwise. We tracked 851 AI/agent-relevant vulnerabilities across the last 30 days, and the attack surface has quietly moved to the plumbing around the model, not the model.
Retrieval-augmented generation accounts for 363 of the 851 CVEs, over 40% of the total. That's the number to sit with. An agent doesn't get attacked through the model weights very often. It gets attacked through the vector database it's pulling from, the chunking logic, the embedding pipeline, the retrieval layer that decides what text the model is allowed to see.
If your agent connects to a knowledge base, that retrieval layer is the most likely place an injection lands. Poison a document in the vector store and every agent that retrieves it is compromised. That's not a model bug. It's a data-layer bug, and it scales with how much of your data you let the agent read.
Model Context Protocol and agent tooling came in second at 226 CVEs. This is the category that barely existed eighteen months ago and is now a distinct attack surface. Every tool your agent can call is a potential privilege boundary. Every MCP server it connects to is a new entry point.
The reason this matters: most teams treat their agent like a black box. They secure the API key and call it done. But the agent is only as safe as the tools it holds. A tool that can reach your database, your email, or your shell is the actual attack surface, and the CVE feed is showing tool-abuse vectors that most teams never model in their threat assessment.
Of the 851, 38 sit in CISA's Known Exploited Vulnerabilities catalog. That's the number I watch first, because KEV means actively exploited in the wild, not theoretical. When an AI/agent vuln shows up there, attackers are using it right now. That's urgency you can't argue with.
Foundation-model CVEs are real, 99 of them, but they're not where the volume is. The model vendors patch fast, and the attack surface is narrower than the ecosystem around the model. The frameworks, the retrieval stacks, the tool layers, the agent runtimes, those get built by a thousand different teams at different security levels. That's where the fragmentation is, and fragmentation is where vulnerabilities accumulate.
If you're shipping an agent in production, the CVE distribution tells you where to spend security effort:
I'm tracking the full agent-security CVE landscape in a live benchmark that updates every day. It pulls fresh signals from CISA KEV and NVD, filters for AI/agent/LLM/MCP relevance, and shows the breakdown by category so you can see where risk is moving before it bites.
I've been on the security side for 14 years, at Wells Fargo and other enterprise shops, and I run a real multi-agent fleet in production. This isn't theory for me. It's the data I use to decide where to harden my own agents, and I'm putting it out there because nobody else is tracking agent security as a category this way.
Related: Prompt Injection: LLM's #1 Risk (2026) · AI System Prompt Scanner · MCP Security Assessment