Loading story…
The Linux Foundation announced a $12.5 million initiative to strengthen open-source security and help maintainers manage a surge of low-quality, AI-generated vulnerability reports that are overwhelming triage and review processes. Funding comes from Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI, and the program will be run through Alpha-Omega and the Open Source Security Foundation (OpenSSF) to improve remediation workflows, expand practical security support, and build longer-term resilience for widely used open-source software.
Project leaders and maintainers said the volume of automated submissions has outpaced the capacity of many open-source teams, turning vulnerability handling into an operational burden. The effort follows complaints from groups including the Python Software Foundation and the cURL project, whose maintainer ended its bug bounty program after being flooded with poor-quality AI-generated reports; GitHub is also providing $5.5 million in Azure credits and support services, while Google said it plans to contribute security tools including Big Sleep, CodeMender, and research such as Sec-Gemini.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A new industry coalition called Athena was formed to improve how vulnerabilities in open source software are identified, triaged, and fixed. Led by Chainguard and involving roughly two dozen companies, the effort said it had already processed more than 20,000 findings and produced over 2,000 patches across 500 open source projects.
The Linux Foundation launched Akrites, an industry initiative to improve validation, remediation, and disclosure of critical open source vulnerabilities before patches reach downstream users. The program includes a shared Security Incident Response Team to validate reports, remove duplicates, and help maintainers coordinate fixes confidentially amid rising AI-driven report volume.
The Linux Foundation announced a new initiative backed by $12.5 million in grants from major technology companies to strengthen open source security and support maintainers. The effort is to be run through Alpha-Omega and the Open Source Security Foundation, with a focus on sustainable security improvements and helping projects handle rising volumes of AI-generated vulnerability reports.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcelinuxsecurity.com
Open sourceitpro.com
Open sourcemedium.com
Open sourcehelpnetsecurity.com
Open sourcego.theregister.com
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Linux Foundation and a coalition of major technology and financial firms have launched **Akrites**, a new initiative designed to protect critical open-source software as AI accelerates vulnerability discovery and exploitation risks. Backers include Amazon Web Services, Anthropic, Cisco, Citi, Ericsson, Google, IBM, JPMorganChase, Microsoft, GitHub, Nvidia, OpenAI, Red Hat, and the Rust Foundation, reflecting broad industry concern over the security of widely used open-source components. Akrites is intended to streamline coordinated vulnerability disclosure and remediation by providing a shared security incident response capability for critical projects. The effort aims to reduce fragmented reporting, duplicate submissions, conflicting fixes, and pressure on already overburdened maintainers, while improving how serious flaws are disclosed and patched across the open-source ecosystem. Early reaction has framed the program as a significant step toward collective defense, though its effectiveness is expected to depend on scaling response capacity, avoiding centralized bottlenecks, and earning the trust of project maintainers.
Jul 22, 2026
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026
AI-powered tools from major technology companies such as Google and OpenAI are increasingly being used to discover vulnerabilities in open-source software, leading to a surge in bug reports for projects maintained largely by volunteers. While these AI systems, like Google's Project Naptime and OpenAI's Aardvark, have successfully identified significant flaws—including a critical vulnerability in OpenSSL (CVE-2024-9143) and a stack buffer underflow in SQLite—the volume and complexity of AI-generated reports are overwhelming open-source maintainers, many of whom lack the resources to address the influx, especially when reports lack accompanying patches. The issue has prompted discussion within the open-source and security communities about the need for new frameworks and scoring systems tailored to AI-discovered vulnerabilities. At the 2025 OWASP Global AppSec USA conference, experts highlighted the limitations of traditional vulnerability scoring models like CVSS for AI-related threats and previewed the development of the OWASP AI Vulnerability Scoring System (AIVSS). This initiative aims to address the unique, non-deterministic risks posed by AI in software security, underscoring the growing recognition that AI-driven vulnerability discovery requires new approaches to risk management and remediation.
Jul 4, 2026