Linux Foundation launches Akrites to patch open-source flaws before AI exploits them

Key takeaway

• The Linux Foundation has launched Akrites, a coordinated initiative with about twenty major tech companies to patch security vulnerabilities in open-source software before AI tools can exploit them.

• Because AI models can now find flaws in large projects in minutes instead of weeks, the industry faces a critical window to fix bugs faster than attackers can weaponize them.

• The initiative consolidates scattered vulnerability reports into a single response team that coordinates fixes with maintainers and steps in to patch critical packages that lack active maintainers.

3 Key Points

FAQ

Which companies are founding members of Akrites?

Founding members include Amazon Web Services, Anthropic, Cisco, Citi, Google, IBM, JPMorganChase, Microsoft, NVIDIA, OpenAI, Red Hat, the Rust Foundation, Vodafone, and Zscaler.

What is the core problem Akrites is trying to solve?

Many organizations scan the same open-source packages independently and report the same findings multiple times, delivering conflicting patches. Maintainers get buried under duplicates while real, exploitable bugs get lost in AI-generated noise. Currently, fewer than five percent of validated open-source vulnerabilities from recent months have been patched.

How does Akrites protect vulnerability details from being leaked?

Akrites uses Coordinated Vulnerability Disclosure with confidentiality at its core: every report starts at TLP:RED, the highest classification level, and only the assigned case team can access it. This way, details about a flaw do not leak before a patch is ready.