Loading story…
The Linux Foundation and a coalition of major technology and financial firms have launched Akrites, a new initiative designed to protect critical open-source software as AI accelerates vulnerability discovery and exploitation risks. Backers include Amazon Web Services, Anthropic, Cisco, Citi, Ericsson, Google, IBM, JPMorganChase, Microsoft, GitHub, Nvidia, OpenAI, Red Hat, and the Rust Foundation, reflecting broad industry concern over the security of widely used open-source components.
Akrites is intended to streamline coordinated vulnerability disclosure and remediation by providing a shared security incident response capability for critical projects. The effort aims to reduce fragmented reporting, duplicate submissions, conflicting fixes, and pressure on already overburdened maintainers, while improving how serious flaws are disclosed and patched across the open-source ecosystem. Early reaction has framed the program as a significant step toward collective defense, though its effectiveness is expected to depend on scaling response capacity, avoiding centralized bottlenecks, and earning the trust of project maintainers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The Linux Foundation announced the launch of Akrites, a new initiative to help defend critical open-source software against AI-enabled cyber threats. The effort is backed by multiple industry members and is intended to coordinate vulnerability remediation and disclosure for open-source projects.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
reversinglabs.com
Open sourcelinuxfoundation.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Linux Foundation announced a **$12.5 million** initiative to strengthen open-source security and help maintainers manage a surge of low-quality, AI-generated vulnerability reports that are overwhelming triage and review processes. Funding comes from **Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI**, and the program will be run through **Alpha-Omega** and the **Open Source Security Foundation (OpenSSF)** to improve remediation workflows, expand practical security support, and build longer-term resilience for widely used open-source software. Project leaders and maintainers said the volume of automated submissions has outpaced the capacity of many open-source teams, turning vulnerability handling into an operational burden. The effort follows complaints from groups including the **Python Software Foundation** and the **cURL** project, whose maintainer ended its bug bounty program after being flooded with poor-quality AI-generated reports; GitHub is also providing **$5.5 million** in Azure credits and support services, while Google said it plans to contribute security tools including **Big Sleep**, **CodeMender**, and research such as **Sec-Gemini**.
Jun 29, 2026
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026
AI-powered tools from major technology companies such as Google and OpenAI are increasingly being used to discover vulnerabilities in open-source software, leading to a surge in bug reports for projects maintained largely by volunteers. While these AI systems, like Google's Project Naptime and OpenAI's Aardvark, have successfully identified significant flaws—including a critical vulnerability in OpenSSL (CVE-2024-9143) and a stack buffer underflow in SQLite—the volume and complexity of AI-generated reports are overwhelming open-source maintainers, many of whom lack the resources to address the influx, especially when reports lack accompanying patches. The issue has prompted discussion within the open-source and security communities about the need for new frameworks and scoring systems tailored to AI-discovered vulnerabilities. At the 2025 OWASP Global AppSec USA conference, experts highlighted the limitations of traditional vulnerability scoring models like CVSS for AI-related threats and previewed the development of the OWASP AI Vulnerability Scoring System (AIVSS). This initiative aims to address the unique, non-deterministic risks posed by AI in software security, underscoring the growing recognition that AI-driven vulnerability discovery requires new approaches to risk management and remediation.
Jul 4, 2026