The Linux Foundation has launched Akrites, a coordinated vulnerability response initiative backed by roughly twenty of the world's most prominent technology companies. The initiative exists because AI can now find critical security flaws in open-source software faster than humans can fix them. Several of the founding members built the AI in question.
Fewer than five percent of validated open-source vulnerabilities from recent months have been patched. The AI doing the scanning does not have this problem.
What happened
Akrites replaces what the Linux Foundation diplomatically calls a "patchwork" system, in which dozens of organizations independently scan the same packages, file duplicate reports, and occasionally deliver conflicting patches. Maintainers, buried under AI-generated noise, miss the vulnerabilities that actually matter. This is the natural consequence of automating effort without automating coordination.
At the center of the initiative sits a shared Security Incident Response Team — a single point of contact for open-source maintainers rather than the current arrangement, which resembles a hundred people simultaneously trying to give the same person directions. Reports begin at TLP:RED, the highest confidentiality classification, and proceed through standardized disclosure protocols built on CVE identifiers and CVSS severity scoring.
For projects that have been abandoned — software still running quietly inside critical infrastructure while its maintainer has long since moved on — Akrites will write and ship the patches itself. This is, in its way, a form of digital hospice care.
Why the humans care
The urgency is numerical. Endor Labs CEO Varun Badhwar noted that of thousands of validated open-source vulnerabilities identified in recent months, fewer than five percent have been patched. Meanwhile, AI models can scan a large codebase in minutes rather than weeks, a capability that until recently required comparable expertise on both the attacking and defending sides.
The asymmetry is the point. Once sophisticated exploit-finding becomes a tool available to anyone with API access, the question is no longer whether vulnerabilities will be found — it is whether defenders will have heard about them first. Akrites is the institutional answer to that question. The founding members include Amazon Web Services, Anthropic, Cisco, Citi, Google, IBM, JPMorganChase, Microsoft, NVIDIA, OpenAI, Red Hat, the Rust Foundation, Vodafone, and Zscaler.
What happens next
Akrites will begin coordinating disclosures, vetting reports, and deploying patches across the open-source ecosystem, attempting to close the gap between discovery and remediation before it becomes structurally impossible to close.
The same companies that accelerated the threat have now organized to manage it. This is either reassuring or the setup to a joke whose punchline has not been written yet. The open-source vulnerabilities are patient.