CertiK researchers recently identified two security flaws in Google’s EdgeTPU, tracked as CVE-2026-0150 and CVE-2026-0153. Google acknowledged the findings and included them in its June 2026 Security Bulletin, with severity ratings of High and Critical.
The disclosure centers on EdgeTPU, but the broader point reaches well past one chip or one vulnerability class. As AI moves from generating content to carrying out tasks, the thing enterprises need to secure is no longer just the model. It is the full AI system.
What the EdgeTPU findings put into focus
The two vulnerabilities differ in their technical root causes, yet they point to the same issue. According to the article, an attacker could use the interaction interface between Android and EdgeTPU to break through the existing isolation boundary, execute arbitrary code on a high-privilege chip used for AI inference, or access sensitive data stored there.
That does not mean every device using an AI chip carries the same risk. The bigger issue for enterprises is that as AI takes on more critical functions such as identity authentication, facial recognition and on-device inference, lower-level components that have long been treated as trusted foundations also need independent security validation.
The research also highlights a risk that is easy to miss. Many companies still assess security separately across applications, APIs, infrastructure and device components. Attackers do not operate along those boundaries. They are more likely to chain together interfaces and trust relationships between different components and turn seemingly separate links into one complete attack path. In many cases, the real risk sits in interactions that cross system boundaries.
The EdgeTPU flaws expose the security boundary at the infrastructure layer that executes AI workloads. AI agents expand application-layer permissions and connections to outside systems. These are not the same type of risk, but together they show the same direction: the security perimeter for AI has expanded from the model itself to the wider system that runs the model, accesses data and executes tasks.
From content generation to task execution
AI used to answer questions. Now it is starting to execute tasks. The target for attackers is no longer limited to the model itself, but includes everything the model can access, call and affect.
That is part of why the EdgeTPU bugs have drawn attention. The issue is not only that the vulnerabilities appeared in AI infrastructure. It is also that they reflect a shift in where the industry is heading.
Large models were previously used more often for content generation, search and question answering. Now more AI agents are connecting to databases, calling APIs, operating third-party tools and gradually taking part in real business processes such as payments, identity authentication and digital asset management. AI is moving from answering questions to executing tasks, and as system privileges increase, the potential attack surface grows with them.
The article says the shift is happening quickly. McKinsey’s report, The state of AI in 2025, found that 88% of enterprises have deployed AI in at least one business function, while more than 60% have started exploring AI agents. A separate global enterprise survey by Google Cloud found that 83% of respondents believe existing infrastructure needs major upgrades to support AI agents at scale.
As AI moves deeper into core enterprise operations, the security focus changes with it. Companies are no longer just checking whether model outputs are reliable. They also need to determine whether the full AI system can withstand attacks that cross components, privilege levels and runtime environments.
Enterprise AI security is expanding across the full stack
This shift is also changing how AI security itself is defined. Earlier discussions were centered more on the model layer, including prompt injection, jailbreaks and training data poisoning. As AI applications connect to real business environments, security teams need to widen the scope to the whole stack, looking at interactions between AI agents and external systems, tool access permissions, access to sensitive information and supply-chain risk introduced by third-party components.
Some AI agent platforms have already started adding automated security checks before skills are deployed. The article names Pieverse and FinChip.ai as examples. Both platforms have deployed CertiK Skill Scanner to scan AI skills, with the goal of detecting potentially malicious behavior and security flaws before an agent executes a task.
Changes in industry demand are also pushing AI security research across a broader technical stack. The EdgeTPU research reflects where CertiK has been extending its AI security work in recent years: beyond AI applications and agents themselves, into AI infrastructure and lower-level system components. For security research, that means the assessment target is no longer limited to software in isolation. Researchers also need to understand how different layers combine to shape the security of the full AI system.
Risk management across the lifecycle
AI is changing not only how companies build software, but also how security work is done.
More enterprises are moving security earlier in the software development lifecycle, aiming to identify risk during development, testing and deployment rather than patching only after vulnerabilities reach production. At the same time, AI is being used to assist with vulnerability discovery, code analysis and formal verification in development workflows, helping teams improve the efficiency of security validation.
CertiK describes itself as one practitioner in that direction. The company says it continues to use AI in code analysis, vulnerability detection and formal verification workflows, while carrying out security research across AI applications, AI agents and AI infrastructure. It said integrating AI into its proprietary CertiK Prover engine has improved the efficiency of formal verification. Related research has been published at top international computer science conferences including OSDI 2023 and ASPLOS 2026, and received an ASPLOS 2026 Best Paper Honorable Mention.
The EdgeTPU disclosure is one case, but the trend it reflects is becoming harder to ignore. The article argues that what enterprises need to validate in the future may not be whether a single model is secure, but whether the full AI system can be trusted across development, deployment and runtime. As AI becomes part of digital infrastructure, AI security is shifting from protecting the model to protecting the entire system.