The Linux Foundation has launched Akrites, a new initiative backed by 19 organizations including Amazon, Anthropic, Google, Goldman Sachs, JPMorganChase, Microsoft, and NVIDIA. The aim: coordinate the patching of critical open-source vulnerabilities before AI-powered attackers can exploit them.
The timing isn’t coincidental. The thinking is that the window between discovery and exploitation has shrunk dramatically in the AI era, and the old model of responsible disclosure simply can’t keep up.
Endor Labs CEO Varun Badhwar put it in stark terms: of the thousands of validated open-source vulnerabilities that AI tools have surfaced in recent months, fewer than 5% have been patched. Of the thousands of bugs found, fewer than five percent get fixed. Akrites is built to close that gap.
How it works: instead of drowning maintainers in a flood of uncoordinated vulnerability reports — the 19 signatories admitted the current approach buries “the maintainers under noise” — Akrites acts as a single, confidential Security Incident Response Team. It coordinates findings with upstream maintainers, funds remediation efforts, and returns fixes on the maintainers’ terms.
The stakes are high because AI tools are finding bugs that humans missed for years. Anthropic’s Claude Opus 4.8 uncovered a critical vulnerability in Zcash’s Orchard privacy pool within a single day. The bug had survived four years of review by cryptographers. Now imagine what a motivated adversary armed with similar capabilities could do.
Akrites also makes a critical commitment: when a widely used package has no active maintainers in place, the initiative will step in to maintain and patch it. For projects that serve as the unacknowledged backbone of the internet, that promise could be more important than anything since the major tech companies decided open source was worth funding.
OpenAI had launched a similar effort called Patch the Planet three days earlier. The difference: Patch the Planet focuses on AI-assisted discovery and delivery, while Akrites is about building long-term coordination infrastructure. Both efforts say they’ll work together rather than compete.
