- Published on
Linux Foundation, Tech Giants Launch Akrites to Defend Open Source Against AI-Powered Attacks
- Authors
- Name
- DeepHorus
The Linux Foundation launched Akrites on Thursday alongside 19 founding organizations—including Amazon, Anthropic, Citi, Google, JPMorganChase, Microsoft, NVIDIA, and OpenAI—to coordinate the patching of critical open-source software before AI-powered attackers can exploit it. The initiative addresses a pressing timeline problem: frontier AI models can now scan a major open-source project and return multiple confirmed vulnerabilities in minutes, work that once took skilled security researchers weeks. As Decrypt reported, Claude Opus 4.8 uncovered a critical flaw in Zcash's Orchard privacy pool within a day, exposing a bug that had survived four years of cryptographer review.
The coordinated disclosure model that predated Akrites was not built for this speed. Multiple organizations would independently scan the same libraries and go through lengthy bureaucratic processes before fixing bugs, a process that an open letter signed by all 19 founding organizations described as burying "the maintainers under noise." According to Endor Labs CEO Varun Badhwar, of the thousands of validated open-source vulnerabilities AI has surfaced in recent months, "fewer than 5% have been patched." This staggering gap leaves the open-source ecosystem dangerously exposed, with AI-enabled attackers racing to exploit weaknesses before fixes are deployed.
Akrites replaces that fragmented process with a single, confidential Security Incident Response Team (SIRT)—one predictable partner for maintainers rather than a flood of uncoordinated reports. Fixes return to each project's original repository on maintainers' terms, using standards for vulnerability tracking. When a critical package has no active maintainer, Akrites commits to stepping in as maintainer of last resort. The program was built first to prevent leaks, with the open letter calling an undisclosed flaw in a widely deployed package "a weapon."
Anthropic Deputy CISO Jason Clinton noted that the existing model for coordinated disclosure "has been outpaced by how quickly AI can now find vulnerabilities"—and that reaching a fix upstream requires coordinating on findings "before they're disclosed and exploited." The founding organizations aim to close this coordination gap, ensuring that vulnerabilities are patched before malicious actors can weaponize them. JPMorganChase CISO Pat Opet emphasized that success is measured by "patch deployment, not patch publication," as adversaries can reverse-engineer a published patch and build a working exploit before many downstream systems have deployed the fix.
Rust Foundation CEO Rebecca Rumbul praised the initiative, stating that the goodwill of open-source maintainers has for too long been taken for granted and that Akrites will help them work in coordination. "Akrites promises meaningful coordination with upstream maintainers, financial, and full-time support to find, fix and disclose security vulnerabilities responsibly," she said. JPMorganChase CISO Pat Opet outlined what success requires: "AI has massively compressed the time between vulnerability discovery and exploitation to near real time," meaning adversaries can act swiftly unless patches are deployed rapidly.
Three days before Akrites, OpenAI launched its own parallel effort, Patch the Planet—a first sprint using GPT-5.5-Cyber and Trail of Bits engineers across 19 open-source projects that merged dozens of patches. OpenAI Cyber Lead Clint Gibler called securing open source "a long-term commitment" for the company and said Akrites helps "strengthen coordination across the industry." Though similar, the two efforts differ in scope: Patch the Planet focuses on AI-assisted discovery and patch delivery with expert human review, while Akrites builds the coordination layer that routes findings to the right maintainers and ensures efficient remediation.
Looking ahead, Akrites presents a scalable model for defending open-source infrastructure against AI-powered threats. By centralizing vulnerability reporting and providing last-resort maintenance, the initiative could significantly reduce the window of exposure for critical projects. The backing of major tech and finance companies suggests that industry leaders recognize open-source security as a shared responsibility. If successful, Akrites could set a new standard for how the community collaborates to protect the digital commons from increasingly sophisticated attacks.
