Anthropic, AWS, Google, Microsoft launch Akrites to coordinate open-source vulnerability response

Frontier AI models can now scan major open-source codebases and surface multiple vulnerabilities in minutes — a capability that benefits defenders and attackers equally. To close the resulting security gap, Akrites launched Thursday as a coordinated vulnerability management body for critical open-source software.

The initiative, hosted by the Linux Foundation, counts 20 founding members including AWS, Anthropic, Google, Microsoft, GitHub, OpenAI, Cisco, Red Hat, NVIDIA, and others. Named after the Akritai — Byzantine soldiers guarding exposed borders — it aims to consolidate fragmented vulnerability discovery before exploits outpace patches.

The problem AI exposed#

Until recently, the open-source security model relied on loose networks of maintainers and researchers filing independent vulnerability reports. When multiple organizations scan the same library using AI tools, maintainers receive duplicative reports that obscure genuine threats. Each additional party sitting on unpatched vulnerability knowledge increases leak risk.

According to Endor Labs CEO Varun Badhwar, AI has already surfaced thousands of validated vulnerabilities in open-source projects, with fewer than 5% patched. The bottleneck has shifted from finding flaws to fixing them — and AI has made that gap critical.

As Anthropic's Jason Clinton notes: "The existing model for coordinated disclosure has been outpaced by how quickly AI can now find vulnerabilities."

Akrites' fix: Single intake, coordinated release#

The core mechanism is a shared Security Incident Response Team (SIRT) that consolidates findings, validates exploitability, and manages a single coordinated fix-and-disclosure workflow. Instead of chaos, maintainers get one reliable signal: confirmed vulnerabilities, tested patches, and a trusted partner.

For unmaintained projects, Akrites steps in as a fallback to ensure fixes reach all dependents. Success is measured by patches deployed to live systems, not publication speed — critical when AI has compressed the time from discovery to exploitation to "near real-time," as JPMorgan Chase CISO Pat Opet puts it.

The initiative operates under three membership tiers: Premier (critical infrastructure operators), General (contributing organizations), and Associate (open-source foundations at no cost). Seed funding comes from Alpha-Omega, an OpenSSF project backed by Anthropic, AWS, Google, Microsoft, and OpenAI.

The timing reflects broader industry concern: Anthropic released Mythos 5 in June specifically for cybersecurity defense with built-in guardrails, only to have the US government suspend it three days later after researchers found ways to misuse it for cyberattacks.