en.Wedoany.com Reported - The Linux Foundation has launched the Akrites project, a new industry initiative aimed at coordinating the discovery, remediation, and responsible disclosure of vulnerabilities in critical open source software, addressing security challenges posed by artificial intelligence-accelerated vulnerability discovery. The project brings together Amazon Web Services, Anthropic, Cisco, Ericsson, Google, IBM, JPMorganChase, Microsoft, NVIDIA, OpenAI, Red Hat, Vodafone, Zscaler, and several other major technology companies, AI developers, financial institutions, telecommunications, and cybersecurity firms, establishing a shared Security Incident Response Team (SIRT) and a unified Coordinated Vulnerability Disclosure (CVD) process.

The Akrites project aims to address challenges posed by cutting-edge AI models, which can analyze large open source codebases and identify security flaws in minutes rather than weeks. Unlike previous open source security efforts that primarily focused on vulnerability discovery or software supply chain transparency, Akrites focuses on coordinating remediation before vulnerabilities are publicly disclosed. The initiative will provide a single coordination point, working with upstream maintainers and leveraging industry-recognized frameworks such as CVE, CWE, CVSS, EPSS, SSVC, VEX, and the Traffic Light Protocol (TLP), avoiding scenarios where multiple organizations independently report and patch the same vulnerability. Participants also include financial institutions such as Citi. The project also plans to coordinate with government cybersecurity efforts and act as a "last maintainer" when critical software projects lose active maintainers.

The project's initial funding comes from the Linux Foundation's directed fund, Alpha-Omega. Concurrent with the launch, founding members published an open letter titled "We All Depend on Open Source. We Will Defend It Together," emphasizing that AI has fundamentally changed the economics of software vulnerability discovery, requiring coordinated industry responses to ensure patches reach critical infrastructure before vulnerabilities are exploited. The Akrites project will launch a shared Security Incident Response Team for critical open source projects, create a standardized, confidentiality-first Coordinated Vulnerability Disclosure process, coordinate vulnerability remediation and public disclosure, support upstream maintainers, and leverage existing security frameworks. Seed funding is provided by the Alpha-Omega project, with founding members spanning cloud providers, AI companies, network equipment vendors, financial institutions, and security firms. Linux Foundation Executive Director Jim Zemlin stated that the initiative reflects a new security reality, where AI has dramatically compressed the time window between vulnerability discovery and potential exploitation, making coordinated industry responses essential to protecting global critical infrastructure.

This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com