AI has changed the rules of the game for open source software security. Finding a critical flaw in a major library used to take a human expert weeks. Today, a machine gets there in minutes, and often surfaces multiple vulnerabilities in a single pass. Faced with this reality, a group of tech heavyweights has decided to act together.
Akrites: The Largest Coordinated Effort in Open Source Security History
On June 25, 2026, an open letter was published on akrites.org under the title “We All Depend on Open Source. We Will Defend It Together”. It announces the launch of Akrites, presented as the largest coordinated effort ever assembled to detect, fix, and responsibly disclose vulnerabilities in critical open source software.
The signatories are far from anonymous: Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, and Zscaler. Several major foundations also back the initiative: OpenSSF, CNCF, OpenJS Foundation, LF Energy, OpenInfra Foundation, and PyTorch Foundation.
Why Now, and Why It’s Urgent
The letter is direct: AI has broken the balance that existed between attackers and defenders. What used to take a human researcher weeks now takes a model minutes. And the same capability that can harden code can be turned against it.
The real-world consequences are already visible. According to Varun Badhwar, CEO of Endor Labs and founding member of Akrites, of the thousands of open source vulnerabilities validated in recent months, fewer than 5% have been fixed. Maintainers are overwhelmed, sometimes unreachable, sometimes absent for years.
The problem doesn’t only affect tech companies. Open source libraries power banking infrastructure, telecommunications networks, electrical grids, and hospital systems. An unpatched flaw in a widely deployed package is, in the letter’s own words, a weapon.
The Coordination Model Akrites Proposes
The current approach is chaotic: dozens of companies scan the same libraries independently, send duplicate reports to maintainers, sometimes with conflicting fixes. The result is noise, confusion, and a prolonged exposure window.
Akrites proposes a different model, built around several principles:
- A single shared SIRT (Security Incident Response Team) to coordinate discovery, remediation, and disclosure.
- Confidentiality as an absolute rule: an undisclosed flaw in a critical package is treated as a weapon, not a report to publish quickly.
- Upstream work: fixes are integrated directly into source projects, in collaboration with maintainers, not in forks or parallel patches.
- Success measured by deployment, not publication: a patch released without being deployed protects no one, and gives attackers the opportunity to reverse-engineer the vulnerability.
- Maintainer of last resort: when a critical package has no active maintainer, Akrites commits to stepping into that role to ensure the fix reaches everyone.
Mark Russinovich, Azure CTO at Microsoft, notes that the initiative builds on the experience of OpenSSF and Alpha-Omega, two programs that have already demonstrated what the industry can accomplish through coordination.
What This Means Concretely for Security Teams
For teams managing infrastructure built on open source components, the implications are direct. Until now, the remediation chain was slow and unpredictable: fragmented discovery, premature public disclosure, exploitation before patches reached production.
If Akrites delivers on its promises, fixes should arrive faster, in a coordinated way, and before adversaries can exploit public disclosures to develop attacks. Chris Wright, CTO of Red Hat, captures the stakes well: “defending this foundation requires a coordinated upstream response capable of meeting threats at scale”.
The participation of Vodafone and Citi, players in critical infrastructure sectors, shows that the initiative isn’t limited to the pure tech ecosystem. Telecom operators and financial institutions have understood that they share the same exposure as software vendors.
Key Takeaways
- Akrites is an initiative launched on June 25, 2026, coordinated by the Linux Foundation, with more than 20 founding member organizations from tech, finance, and telecoms.
- AI has reduced the time to discover open source vulnerabilities from weeks to minutes, making current coordination models obsolete.
- The project relies on a shared SIRT, confidentiality of vulnerabilities before fixes are ready, and upstream work with maintainers.
- Success is measured by effective patch deployment, not publication.
- Fewer than 5% of recently validated open source vulnerabilities have been fixed: the remediation backlog is massive and time is running out.
If you work on software supply chain security or want to follow Akrites closely, feel free to reach out or follow this blog for upcoming analyses.
Sources
- Akrites Open Letter, akrites.org, June 25, 2026
- Google Open Source Blog, opensource.googleblog.com
- OpenSSF, openssf.org
- Cloud Native Computing Foundation, cncf.io
- Linux Foundation, linuxfoundation.org