Akrites, a major industry coalition established by the Linux Foundation and the Open Source Security Foundation (OpenSSF) to protect critical open-source software from AI-enabled cyber threats, is expected to launch its vulnerability disclosure and remediation platform in September 2026. The initiative, announced in late June 2026, aims to coordinate AI-enabled vulnerability reports and facilitate fixes for the open-source ecosystem.
Christopher 'CRob' Robinson, OpenSSF's CTO and Akrites' CTO, stated that the platform's sole mission is to coordinate these reports to upstream open-source maintainers, ensuring that solutions are available across the entire ecosystem. The initiative’s tooling, including its vulnerability management and Shared Security Incident Response Team (SIRT) platform, has produced its initial draft.
The core of Akrites' platform will be based on the Vulnerability Information and Coordination Environment (VINCE), a vulnerability management platform developed in 2020 by the Computer Emergency and Response Team Coordination Center (CERT/CC) at Carnegie Mellon University's Software Engineering Institute (SEI). This platform will incorporate additional capabilities leveraging large language models (LLMs) for tasks such as deduplication and patch creation.
Robinson noted that he has already received thousands of vulnerability reports since the project's launch two months prior, with an estimated 30% being duplicates. The team is currently conducting a penetration test and security audit with experts from Akrites members. Following this, the tools will be augmented to process a combination of real and synthetic data to ensure proper functionality. Once finalized, the platform will be open-sourced for broader use.
Akrites was launched with over 20 founding members, including AI frontier labs like Anthropic and OpenAI; cloud and tech giants such as Amazon Web Services, Cisco, Google, Microsoft (and its subsidiary GitHub), IBM (and its subsidiary Red Hat), and NVIDIA; cybersecurity firms like Chainguard, Endor Labs, and Zscaler; and large enterprises including Citi, JPMorganChase, Ericsson, and Vodafone.
Member organizations are required to contribute between one and ten engineers to the project and pay membership fees based on three tiers: Associate, General, and Premier, each offering different levels of benefits.
The Linux Foundation outlined two primary missions for Akrites at its launch: establishing a shared SIRT for mitigating and remediating vulnerabilities in open-source packages and libraries, and developing a standardized coordinated vulnerability disclosure (CVD) process built on confidentiality-first principles and industry-standard tooling. The platform is anticipated to "go live" and begin accepting automated vulnerability reports in September.
