AI security risks without vendor fix