The Linux Foundation has launched Akrites to improve the security of open-source software against AI threats, backed by major tech companies.
New Initiative Aims to Secure Open Source Software
The Linux Foundation has unveiled Akrites, a new initiative designed to address vulnerabilities in open-source software before they can be exploited by AI-driven attacks. Supported by 19 founding organizations, including major tech firms like Amazon, Microsoft, and Google, Akrites aims to enhance the coordination of vulnerability remediation efforts.
In recent months, AI has demonstrated an alarming ability to quickly identify vulnerabilities in open-source projects, with less than 5% of these issues being resolved according to Varun Badhwar, CEO of Endor Labs. The rapid pace of AI discovery has outstripped the traditional coordinated disclosure model, which often involves lengthy bureaucratic processes that hinder timely responses.
Addressing Vulnerabilities More Efficiently
Akrites will establish a centralized Security Incident Response Team to streamline the reporting and fixing of vulnerabilities. This approach seeks to provide maintainers with a reliable partner rather than a flood of uncoordinated reports, enabling fixes to be integrated directly into project repositories. In cases where a critical package lacks an active maintainer, Akrites will step in as a last-resort maintainer.
Jason Clinton, Deputy CISO at Anthropic, emphasized the urgency of improved coordination, noting that AI’s speed in finding vulnerabilities necessitates a new approach to disclosure. The previous model has proven inadequate in light of the rapid discoveries made possible by AI technologies.
Collaboration and Support from Tech Giants
Rebecca Rumbul, CEO of the Rust Foundation, highlighted the importance of this initiative in supporting open-source maintainers, whose goodwill has often been overlooked. Akrites will offer financial and full-time support to help responsibly identify, fix, and disclose security vulnerabilities.
JPMorgan Chase's CISO, Pat Opet, defined success for Akrites as effective patch deployment rather than mere publication, stressing the need for quick action in a landscape where vulnerabilities can be exploited almost in real-time.
In a related effort, OpenAI recently launched its own project, Patch the Planet, which focuses on AI-assisted vulnerability discovery and patch delivery. While both Akrites and Patch the Planet aim to enhance security in the open-source ecosystem, they differ in their approach: Akrites emphasizes coordination of findings, while Patch the Planet focuses on rapid patching with expert oversight.
Funding and Future Participation
The Linux Foundation’s Alpha-Omega fund will initially support Akrites, which has already awarded over $20 million in grants to open-source security projects since 2022. Other organizations are encouraged to participate by contributing resources or funding to the initiative.
