The Linux Foundation has launched Akrites, an initiative intended to coordinate vulnerability discovery, remediation and disclosure for critical open-source software.
The project arrives as AI-enabled vulnerability scanning changes the scale at which potential software flaws can be identified.
Its central emphasis is not simply finding more issues, but getting fixes made upstream and patches deployed.
Akrites is organized around a multi-stakeholder coalition that includes technology vendors, financial institutions and open-source foundations.
The official Akrites open letter describes the effort under the message, “We All Depend on Open Source.
We Will Defend It Together.” The initiative was launched on June 25, 2026 and is coordinated by the Linux Foundation.
The publicly displayed letter includes organizations such as AWS, Anthropic, Chainguard, Cisco, Citi, Google, Microsoft and GitHub, JPMorganChase, IBM, NVIDIA and OpenAI, Endor Labs, Red Hat, the Rust Foundation, Sonatype, Vodafone and Zscaler.
It also lists open-source groups including the Cloud Native Computing Foundation, OpenInfra Foundation, OpenJS Foundation, LF Energy, OpenSSF and the PyTorch Foundation.
What Akrites is trying to change Akrites is focused on a practical security lifecycle: identifying vulnerabilities in critical open-source projects, helping drive remediation and handling disclosure.
That focus matters because discovering a possible vulnerability is only an early stage of risk reduction.
A finding has limited value if maintainers cannot address it, if the correction is not adopted upstream, or if downstream users do not deploy the available patch.
The initiative therefore places upstream fixes and patch deployment at the center of its stated success measures.
This is a meaningful distinction from approaches that judge progress largely by the number of vulnerabilities found or reports generated.
The coalition combines several types of participants: Cloud, software and security vendors, including AWS, Google, Microsoft, Cisco, Red Hat and Zscaler.
AI and developer-security companies, including Anthropic, OpenAI, Chainguard and Endor Labs.
Open-source foundations and communities, including OpenSSF, CNCF, OpenInfra Foundation, OpenJS Foundation and the Rust Foundation.
Organizations that rely on software supply chains, including Citi, JPMorganChase and Vodafone.
The public letter displays roughly 25 to 30 organizations, rather than a coalition of more than 100 signatories.
Its stated scope is also narrower than a broad regulatory or cross-sector cyber-defense policy campaign.
Akrites is specifically aimed at coordinating work on critical open-source software vulnerabilities.
Why AI changes the pressure on remediation AI-enabled scanning can increase the volume of potential vulnerabilities that security researchers, maintainers and software users need to assess.
Akrites frames this as a coordination problem as much as a discovery problem.
More findings can create more work for the people responsible for validating reports, preparing fixes, communicating disclosures and deploying patches.
That makes the project's remediation-first approach notable.
The relevant question for users of open-source software is not only whether a vulnerability can be found, but whether a trustworthy fix reaches the project and then reaches the systems that depend on it.
The initiative does not, based on the public letter, announce a new commercial security product, pricing model or mandatory compliance framework.
Its significance lies in the attempt to align organizations around the operational stages that follow discovery.
What businesses should take from the initiative For businesses that use software built on open-source components, Akrites is a reminder that vulnerability management is broader than purchasing a scanning tool.
The initiative's own priorities point to the importance of understanding whether issues are remediated upstream and whether relevant patches are ac