In a significant move to bolster the security of vital open-source software against the rising tide of AI-enabled cyber threats, an industry coalition known as Akrites is gearing up to launch its vulnerability disclosure and remediation platform in September. This initiative, which aims to safeguard critical software infrastructures, was established at the end of June 2026 through a coalition led by the Linux Foundation in collaboration with the Open Source Security Foundation (OpenSSF) and supported by over twenty founding members.
Among the coalition’s members, notable technology leaders in AI and cloud computing include Anthropic, OpenAI, Amazon Web Services, Cisco, Google, Microsoft (along with its subsidiary GitHub), IBM, Red Hat, and NVIDIA. Cybersecurity companies such as Chainguard, Endor Labs, and Zscaler, along with large corporations like Citi, JPMorgan Chase, Ericsson, and Vodafone, are also contributing to this enterprise. Each of these members is required to allocate between one and ten engineers to the project, while also paying membership fees that vary by tier—Associate, General, and Premier—each offering different levels of benefits.
Upon its launch, the Linux Foundation highlighted two pivotal missions for Akrites. The first is to establish a shared security incident response team (SIRT) focused on effectively identifying, mitigating, and fixing vulnerabilities within open-source packages and libraries. The second mission emphasizes the development of a standardized coordinated vulnerability disclosure (CVD) process, rooted in principles of confidentiality and utilizing industry-standard tools to streamline communication around vulnerabilities.
In an interview with Infosecurity, Christopher ‘CRob’ Robinson, who has been appointed as the CTO of Akrites in addition to his role as OpenSSF’s chief security architect, elaborated on the coalition’s key objectives. Robinson described the overarching mission of Akrites as “coordinating AI-enabled vulnerability reports to upstream open-source maintainers,” ensuring that necessary fixes are disseminated throughout the entire ecosystem.
Robinson also shared insights about the development of the initiative’s tools, noting that the team has successfully created “the first draft of the tool chain.” Central to this effort will be the use of Carnegie Mellon University’s Vulnerability Information and Coordination Environment (VINCE), a platform for vulnerability management that was initially developed in 2020 by the university’s Computer Emergency and Response Team Coordination Center (CERT/CC). This foundation will enable Akrites to leverage additional capabilities, including intelligent processing powered by large language models (LLMs) for tasks such as deduplication of reports and patch creation.
In the early stages following the launch, the Akrites team has already gathered thousands of vulnerability reports. Robinson indicated that about 30% of these reports have been identified as duplicates, which underscores the need for a systematic and effective management approach. To further enhance security frameworks, Robinson announced that experts from Akrites member organizations will conduct penetration tests and security audits. This will enable the initiative to refine its tools and processes, ensuring the platform can effectively manage both real and synthetic data inputs.
As the project nears its operational launch, the platform is being designed with open-source principles, allowing anyone interested to utilize the tools for their own security needs. Robinson has expressed a strong sense of optimism regarding the success of Akrites. He stated, “I have been trying to do something like Akrites my whole career. I feel right now we have the tools, the willpower, and access to the technical experts, so I’m very optimistic about our chances of providing a valuable service to the global open-source ecosystem.”
With its ambitious mission and robust backing from industry leaders, Akrites is poised to make a meaningful impact on the landscape of open-source software security. The initiative represents a proactive approach to addressing the challenges posed by AI-generated vulnerabilities, underscoring the coalition’s commitment to maintaining the integrity and safety of open-source software in an increasingly complex digital landscape.
As September approaches, many in the tech community are eagerly anticipating the rollout of Akrites and its potential to transform the way vulnerabilities in open-source projects are managed and addressed. Further updates on this initiative and similar efforts aimed at combating the surge in AI-driven vulnerabilities will be provided by Infosecurity as developments unfold.