Open-source software already runs much of the modern world. Banks, hospitals, telecoms, governments, power grids, cloud platforms and AI systems all depend on shared code maintained across the open-source ecosystem.
Now the Linux Foundation and a group of major technology and security organisations are warning that AI has changed the threat model — and that open source needs a more coordinated defence.
What happened?
On June 25, 2026, the Linux Foundation announced Akrites, a new coordinated effort to find, fix and responsibly disclose vulnerabilities in critical open-source software.
The launch is backed by major organisations including Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, NVIDIA, OpenAI, RapidFort, Red Hat, the Rust Foundation, Sonatype, Vodafone and Zscaler.
Alongside the announcement, the founding signatories published an open letter titled “We All Depend on Open Source. We Will Defend It Together.”
Why it matters
Open-source vulnerabilities do not stay isolated inside one company. A single widely used package can sit underneath banks, hospitals, telecoms networks, government systems, energy infrastructure and AI platforms.
Akrites is built around the idea that success should not be measured only by publishing a patch, but by whether that patch actually reaches the systems that depend on it.
That distinction matters because once a patch becomes public, attackers can use AI to reverse engineer the underlying vulnerability and move quickly against unpatched systems.
What the details show
The central claim is that AI has compressed the time needed to discover serious vulnerabilities.
The Akrites letter argues that work which once took expert researchers weeks can now be done by machines in minutes, sometimes producing multiple vulnerabilities in a single pass.
That creates a new pressure point: discovery is speeding up faster than maintainers can triage, patch and coordinate disclosures.
Akrites is designed to respond by creating:
- a shared Security Incident Response Team;
- a standard coordinated vulnerability disclosure process;
- a confidential place to validate vulnerabilities;
- upstream fixes with maintainers;
- responsible disclosure; and
- stronger real-world patch deployment.
Reading between the lines
The important shift is that the industry is no longer treating open-source security as a side issue for unpaid maintainers to absorb.
Akrites is a recognition that shared code has become shared infrastructure.
If dozens of companies independently scan the same project and report the same flaws, maintainers can get buried under duplicate reports. If several organisations hold an unpatched vulnerability at the same time, the risk of leaks and exploitation increases.
The initiative is trying to replace fragmented reporting with one coordinated pipeline:
- find the issue;
- work with maintainers;
- build the fix upstream;
- disclose responsibly; and
- push for real-world patch deployment.
What we do not know yet
The biggest unknown is how this will work in practice across the messy reality of open-source development.
Several questions still matter:
- Which projects will be considered critical?
- How will maintainers experience the process?
- How will Akrites avoid becoming another layer of corporate control over community projects?
- How quickly can fixes move from upstream patches to downstream deployment?
- How will the group balance confidentiality with the open culture that makes open source work?
Those questions will determine whether Akrites becomes a meaningful defence mechanism or another well-intentioned security initiative.
What happens next?
Akrites will focus on critical open-source software and work upstream with maintainers.
Participating organisations are expected to contribute engineering resources, security expertise, tooling or funding.
The Linux Foundation says the initiative will use confidentiality-first principles, industry-standard tooling, a shared Security Incident Response Team, and a single coordinated disclosure process.
The open letter also says Akrites may act as a maintainer of last resort when a critical package has no active maintainer available to carry a fix through.
Bottom line
Akrites is not just another open-source awareness campaign. It is an attempt to build a coordinated defence layer around the shared software that modern infrastructure depends on.
The promise is simple: if AI can help attackers and researchers find vulnerabilities faster, then open-source defence has to scale faster too.