{"id":25759,"date":"2026-07-16T16:40:43","date_gmt":"2026-07-16T15:40:43","guid":{"rendered":"https:\/\/telecomkh.info\/?p=25759"},"modified":"2026-07-16T16:40:43","modified_gmt":"2026-07-16T15:40:43","slug":"linux-foundation-and-industry-leaders-launch-akrites-to-defend-critical-open-source-software-against-ai-enabled-cyber-threats","status":"publish","type":"post","link":"https:\/\/telecomkh.info\/?p=25759","title":{"rendered":"Linux Foundation and industry leaders launch Akrites to defend critical open source software against AI-enabled Cyber Threats"},"content":{"rendered":"

Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone and Zscaler join coordinated effort to find, fix and responsibly disclose vulnerabilities in open source software the world runs on<\/strong><\/p>\n

The Linux Foundation, the nonprofit organization enabling mass innovation through open source, announced Akrites, a coordinated industry effort to harden the world\u2019s most critical open source software in the era of AI-assisted vulnerability discovery. Backed by founding commitments from Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone and Zscaler, the initiative unites major technology companies, AI labs, financial institutions, and security vendors around a shared mission: to coordinate the remediation of vulnerabilities in widely used open source projects with upstream maintainers before those vulnerabilities can be exploited.
\nOpen source software underpins virtually every layer of the modern digital economy, from banking and healthcare to energy, transportation, telecommunication, and government. Akrites enables industry coordination to support and defend critical infrastructure users and consumers of open source. Previously, finding and fixing serious flaws in open source software demanded comparable expertise from attackers and defenders alike. Today, frontier AI models can scan a major open source project and surface vulnerabilities in minutes. Once access to these capabilities is broadly available, bad actors who previously lacked the technical expertise to mount sophisticated attacks will have the tools they need to do so quickly.
\nTo mark the launch, the founding signatories published a joint open letter to the technology industry, \u201cWe All Depend on Open Source. We Will Defend It Together.\u201d The full letter is available at https:\/\/akrites.org\/letter\/.
\nIn the past, security response involved a patchwork of organizations often working on the same problems independently, sometimes shipping conflicting patches or burying maintainers under duplicate reports. Akrites changes that model. The initiative provides a single, trusted place to coordinate, remediate and disclose, with a shared SIRT serving as a predictable partner for maintainers rather than a flood of uncoordinated reports. Akrites commits to working with critical infrastructure to support patch deployment before vulnerable systems can be targeted.
\nConfidentiality is central to the effort. Bug fixes flow back into each project\u2019s original home, on maintainers\u2019 terms. Where a critical package has no active maintainer, Akrites will serve as maintainer of last resort so fixes to the latest version reach everyone in a timely fashion. The initiative will also coordinate with government efforts so public and private defenders move together.
\nAlpha-Omega, a directed fund of the Linux Foundation, will provide seed funding to support Akrites. Other organizations that contribute engineering resources or funding to the security of critical open source are invited to participate. To learn more or to join, visit https:\/\/akrites.org.<\/p>\n

Supporting Quotes<\/strong>
\n\u201cFrontier AI models have given defenders the ability to find and fix vulnerabilities in open source software at a speed and scale that were never possible before. That’s an enormous opportunity for defenders, and Akrites ensures we seize it together. Maintainers deserve a coordinated partnership, not a flood of reports. AWS is committed to securing the projects our customers depend on and building this shared infrastructure alongside the community.\u201d
\n\u2013 Matt Wilson, Vice President and Distinguished Engineer, Amazon Web Services<\/p>\n

\u00abOpen source projects collectively underpin much of the internet, and the existing model for coordinated disclosure has been outpaced by how quickly AI can now find vulnerabilities. Getting ahead of that requires the industry to coordinate on findings and get fixes upstream before they’re disclosed and exploited. Efforts like Akrites drive this level of coordination at the scale and speed this moment requires.\u00bb
\n\u2013 Jason Clinton, Deputy Chief Information Security Officer, Anthropic<\/p>\n

\u00abThe software supply chain is only as strong as the upstream it draws from, and we see how thin that layer really is. As AI finds more vulnerabilities, the industry will rush to patch them. Without coordination, those fixes will fragment across different patches and forks, and maintainers who are already overwhelmed, unreachable, or haven’t touched a project in years. Akrites gives the industry one coordinated way to fix vulnerabilities upstream before they’re exploited, with maintainers still in control. Now the work is making sure there’s always someone on the other end to catch them.\u00bb
\n\u2013 Dan Lorenc, CEO and Co-founder, Chainguard<\/p>\n

\u00abFinding a serious open source vulnerability used to take an expert weeks. It now takes a machine minutes. When maintainers lose that race, so does everyone else. No single company, no single maintainer, and no single government can close that gap alone. That is why Cisco is bringing its networking infrastructure, security expertise, and decades of open source contribution to Akrites – because defenders cannot afford to lose, and maintainers cannot be left to run this alone.\u00bb
\n\u2013 Vijoy Pandey, Senior Vice President and General Manager, Outshift by Cisco<\/p>\n

\u201cAdvances in AI models have significantly reduced the effort required to discover and exploit vulnerabilities. In partnership with the Linux Foundation and Project Akrites, Citi is committed to supporting the open-source ecosystem by helping to build a framework that identifies and remediates vulnerabilities and shares proposed patches. Focused on securing critical infrastructure, this initiative is a key part of our efforts to help the industry mitigate emerging threats.\u201d
\n\u2013 Al Tarasiuk, Chief Information Security Officer, Citi<\/p>\n

\u00abFor years we have believed finding vulnerabilities was never the hard part. Fixing them was. AI has made that gap impossible to ignore. Of the thousands of validated open source vulnerabilities surfaced in recent months, fewer than 5% have been patched. Endor Labs is a founding member of Akrites because it is built for the response this moment needs: coordinated remediation upstream, handled confidentially, with maintainers in control, so one trusted fix reaches everyone who depends on the code.\u00bb
\n\u2013 Varun Badhwar, CEO and Co-Founder, Endor Labs<\/p>\n

\u201cVulnerability discovery is now moving at a speed that overwhelms both the maintainers who sustain open source projects and the users who rely on them. Uncoordinated reporting, patching, and disclosure create friction, putting the entire ecosystem at risk. No single organization can solve this alone. That is why Ericsson is joining Akrites as a Premier member, contributing funding and talent to a shared effort to keep open source software secure and thriving.\u201d
\n\u2013 Mikko Karikyt\u00f6, Chief Product Security Officer, Ericsson<\/p>\n

\u201cAs AI accelerates both the scale and speed of vulnerability discovery, defending the open source ecosystem requires an equally rapid, coordinated response. By joining Akrites, we are combining Google’s long-standing commitment to open source security with industry-wide expertise to ensure that vulnerabilities are found, fixed, and responsibly disclosed before they can be exploited. Safeguarding the software that powers the world’s critical infrastructure is essential to maintaining trust in our digital future.\u201d
\n\u2013 Heather Adkins, Vice President Security Engineering, Google<\/p>\n

\u201cOpen source powers the systems we rely on every day \u2013 running everything from banks and hospitals to power grids and AI platforms. As frontier AI accelerates vulnerability discovery, the risk has grown too large for any one organization to address alone. That\u2019s why an ecosystem approach is critical, bringing the community, technology providers, and enterprises together to ensure vulnerabilities are addressed and at the new speed required today.\u201d
\n\u2013 Jamie Thomas, Enterprise Security Executive, IBM<\/p>\n

\u201cAI has massively compressed the time between vulnerability discovery and exploitation to near real time, which means we have to compress the time from fix to deployment. That\u2019s why we at JPMorganChase are helping to build this effort to measure success in patch deployment, not patch publication. We support a mechanism that enables downstream operators of critical infrastructure so that fixes reach real systems before adversaries can turn disclosures into exploits. And upstream, we owe maintainers a single, reliable signal: confirmed vulnerabilities, well-tested proposed fixes, and a predictable partner they can trust, rather than a flood of duplicative, conflicting reports.\u201d
\n\u2013 Pat Opet, Chief Information Security Officer, JPMorganChase<\/p>\n

\u201cOpenSSF and Alpha-Omega demonstrated what is possible when industry comes together to strengthen open source security. Building on our experience co-founding these organizations, Akrites was created to address the emerging inflection point of AI-powered vulnerability discovery and defense. As a founding member, Microsoft and GitHub will contribute expertise, resources, and AI technologies to help responsibly identify and fix vulnerabilities across the open source software ecosystem that customers and organizations depend on.\u201c
\n\u2013 Mark Russinovich, Azure Chief Technology Officer, Deputy Chief Information Security Officer and Technical Fellow, Microsoft<\/p>\n

\u201cTransparency and open collaboration are how the cybersecurity community has kept infrastructure safe for decades. In the age of AI, these open source foundations have never been more critical. Open source AI is the engine of American innovation \u2014 and one of our most powerful tools for deploying AI with the security, trust, and transparency needed to power this industrial revolution.\u201d
\n\u2013 David Reber, Chief Security Officer, NVIDIA<\/p>\n

\u201cThe world runs on open source, and securing it is a long-term commitment for us at OpenAI. Through Patch the Planet, we\u2019re putting our models and resources behind expert-led work that helps maintainers validate issues and land fixes, and we’re proud to participate in Akrites to strengthen coordination across the industry and help defend the software we all depend on.\u201d
\n\u2013 Clint Gibler, Cyber Lead, OpenAI<\/p>\n

\u201cOpen source only works when we keep the work open, upstream, and available to everyone who depends on it. The answer to the AI-driven vulnerability crisis is not to fragment the ecosystem behind proprietary walls or turn community foundations into closed products. It must be coordinated remediation that preserves the integrity of original software, works with maintainers, and returns fixes to the commons. We are proud to support the Akrites initiative which aligns with our belief of strengthening the open source ecosystem from within, helping organizations reduce risk without unnecessary code changes, and making the software we all share safer for everyone.\u201d
\n\u2013 Mehran Farimani, CEO, RapidFort<\/p>\n

\u201cOpen source is the foundation of modern software innovation. Defending that foundation requires a coordinated, upstream community response capable of meeting threats at scale. Red Hat\u2019s participation in Akrites focuses on strengthening this upstream ecosystem. By collaborating openly to identify and patch vulnerabilities at the source, we help build a more resilient software supply chain for the entire industry.\u201d
\n\u2013 Chris Wright, Chief Technology Officer and Senior Vice President, Global Engineering, Red Hat<\/p>\n

\u201cFor too long, the goodwill and sense of responsibility among upstream maintainers has been taken for granted in security response processes. Akrites promises meaningful coordination with upstream maintainers, financial, and full-time support to find, fix and disclose security vulnerabilities responsibly, and a genuine commitment from the most influential companies across tech and finance to solve this problem. The Rust Foundation looks forward to working with Akrites to develop security that is fit for the future.\u201d
\n\u2013 Rebecca Rumbul, Executive Director and CEO, Rust Foundation<\/p>\n

\u201cSonatype sees the dependency graph of the modern world every day. A single vulnerable component can sit underneath thousands of organizations, which means one upstream fix can reduce risk across an entire ecosystem. AI may make vulnerability discovery dramatically easier, but it does not make coordinated repair automatic. Akrites is important because it gives the industry a confidential way to do that work together, upstream, before the same flaw becomes thousands of separate incidents.\u201d
\n\u2013 Brian Fox, Co-founder and Chief Technology Officer, Sonatype, and Steward of Maven Central<\/p>\n

\u201cWith the increasing ability of AI to fast-track vulnerability discovery, now is the right time to come together and invest resources to safeguard critical open-source software on which telecommunications and many other industries rely on. As a founding member, Vodafone has committed both expertise and funding to Akrites. This unified initiative will drive a co-ordinated, industry-wide approach to responsibly identify and fix vulnerabilities in the software that runs the systems upon which the world depends.\u201d
\n\u2013 Paul Hopkins, Cyber & IT strategy and Architecture Director, Vodafone<\/p>\n

\u201cAI has changed the speed of both offense and defense. Vulnerabilities can now be found at machine speed, which means defenders have to move just as fast. Akrites helps turn that speed into an advantage for the open source ecosystem by finding issues earlier, coordinating remediation responsibly, and pushing fixes upstream. Zscaler is proud to be part of it.\u201d
\n\u2013 Deepen Desai, Executive Vice President and Chief Security Officer, Zscaler<\/p>\n","protected":false},"excerpt":{"rendered":"

Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone and Zscaler join coordinated effort to find, fix and responsibly disclose vulnerabilities in open source software the world runs on The Linux Foundation, the nonprofit organization enabling mass innovation through … <\/p>\n

Continue reading \u00abLinux Foundation and industry leaders launch Akrites to defend critical open source software against AI-enabled Cyber Threats\u00bb<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":25760,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[24],"tags":[],"_links":{"self":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts\/25759"}],"collection":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=25759"}],"version-history":[{"count":1,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts\/25759\/revisions"}],"predecessor-version":[{"id":25761,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/posts\/25759\/revisions\/25761"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=\/wp\/v2\/media\/25760"}],"wp:attachment":[{"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25759"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/telecomkh.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}