Linux Foundation launches Akrites to patch open-source flaws before AI exploits them

What happened

The Linux Foundation announced Akrites, a coordinated industry initiative bringing together about twenty tech companies—including Amazon Web Services, Anthropic, Google, IBM, Microsoft, NVIDIA, and OpenAI—to fix security vulnerabilities in widely used open-source software before attackers can exploit them. At its core is a shared Security Incident Response Team that acts as a single point of contact for maintainers instead of dozens of organizations independently reporting the same flaws.

Why it matters

AI models can now scan large open-source projects in minutes instead of weeks, exposing flaws far faster than before. This shifts the balance: attackers without deep technical skills will soon have the tools for sophisticated exploits. Currently, fewer than five percent of validated open-source vulnerabilities from recent months have been patched, and maintainers get buried under duplicate reports while real bugs get lost in noise. A shared response team aims to cut through this inefficiency.

What to watch

When a critical package no longer has an active maintainer—a common problem in volunteer-run projects—Akrites plans to step in as a "maintainer of last resort" and ship fixes itself so patches reach all users in time. Seed funding comes from Alpha-Omega, a directed fund under the Linux Foundation, and other organizations can contribute engineering resources or funding.