Linux Foundation Launches Akrites, an Industry Alliance to Patch Open Source Flaws Before AI Turns Them Into Exploits
The Linux Foundation and roughly 20 companies including AWS, Anthropic, Google, IBM and major banks launched Akrites, a coordinated incident-response alliance for open source software, after finding fewer than 5% of recently surfaced vulnerabilities have been patched.
Overview
The Linux Foundation announced on June 25, 2026 the launch of Akrites, a coordinated industry effort to remediate and disclose vulnerabilities in critical open source software. The initiative brings together roughly 20 founding organizations — including Amazon Web Services, Anthropic, Google, Microsoft, IBM, Cisco, NVIDIA, OpenAI, Red Hat, and banks such as Citi and JPMorganChase — around a shared incident-response process built to close a gap the announcement itself quantified starkly: of the thousands of validated open source vulnerabilities surfaced in recent months, fewer than 5% have been patched.
What We Know
Akrites establishes a shared Security Incident Response Team (SIRT) and a single, standardized Coordinated Vulnerability Disclosure (CVD) process for critical open source projects, according to the Linux Foundation. The process is described as “built on confidentiality-first principles and industry-standard tooling,” and founding members are contributing engineering talent, security expertise, and funding to harden software that, in the Foundation’s framing, banks, hospitals, power grids, telecoms, governments, and AI labs all depend on.
The announcement frames Akrites as a direct response to how generative AI has compressed the time it takes to find flaws in widely used code. “Today, frontier AI models can scan a major open source project and surface vulnerabilities in minutes,” the Linux Foundation said. Vijoy Pandey, Senior Vice President and General Manager of Outshift by Cisco, put it more bluntly: “Finding a serious open source vulnerability used to take an expert weeks. It now takes a machine minutes. When maintainers lose that race, so does everyone else. No single company, no single maintainer, and no single government can close that gap alone.”
Other founding members echoed the same theme. Matt Wilson, Vice President and Distinguished Engineer at Amazon Web Services, said “frontier AI models have given defenders the ability to find and fix vulnerabilities in open source software at a speed and scale that were never possible before.” Jason Clinton, Deputy Chief Information Security Officer at Anthropic, said “open source projects collectively underpin much of the internet, and the existing model for coordinated disclosure has been outpaced by how quickly AI can now find vulnerabilities.” Pat Opet, Chief Information Security Officer at JPMorganChase, said “AI has massively compressed the time between vulnerability discovery and exploitation to near real time, which means we have to compress the time from fix to deployment.”
SecurityWeek reports that Akrites is meant to counter attackers who now use AI to “rapidly reverse engineer the underlying vulnerabilities, develop exploits, and launch attacks” once patches become public — meaning the coalition is racing not just to find bugs but to get fixes deployed before adversaries can weaponize the disclosure itself. The Linux Foundation’s language captures that shift in priority directly: “the success of our efforts, therefore, will be measured in patch deployment, not publication,” per SecurityWeek’s reporting. For projects that have no active maintainer, the Linux Foundation says Akrites “will serve as maintainer of last resort so fixes to the latest version reach everyone in a timely fashion.”
Akrites is designed to sit alongside, not replace, existing Linux Foundation security efforts. Mark Russinovich, Azure Chief Technology Officer, Deputy Chief Information Security Officer and Technical Fellow at Microsoft, said “OpenSSF and Alpha-Omega demonstrated what is possible when industry comes together to strengthen open source security.” InfoQ describes the new group as adding “an operational response layer dedicated to coordinating the remediation of critical vulnerabilities before public disclosure,” while the Open Source Security Foundation continues to focus on developing security standards and tooling. Seed funding for Akrites comes through Alpha-Omega, the Linux Foundation-directed fund that also backs OpenSSF.
As previously reported, a separate group of seven AI companies pledged $12.5 million in March 2026 through the same Alpha-Omega fund to help maintainers triage a flood of AI-generated vulnerability reports. Akrites is a distinct, larger effort: rather than helping maintainers sort through low-quality automated bug reports, it builds a standing, shared incident-response process for validated, critical vulnerabilities, with banks and telecom operators — not just AI labs — as founding members.
What We Don’t Know
The Linux Foundation has not disclosed a specific budget figure for Akrites beyond noting that Alpha-Omega provides seed funding and that member organizations separately contribute engineering resources. Reporting also varies slightly on the exact founding-member count — the Linux Foundation’s own announcement names 19 organizations, while InfoQ describes “more than 20 founding organizations” — and neither the announcement nor the coverage reviewed specifies a timeline for when Akrites’s SIRT will handle its first coordinated disclosure case.