Linux Foundation launches Akrites to coordinate open-source vulnerability response

The Linux Foundation has launched Akrites, an initiative to coordinate how vulnerabilities in critical open-source software are found, fixed and disclosed. According to dev.to, the project went live on June 25, 2026 and is anchored by an open letter carrying the message "We All Depend on Open Source. We Will Defend It Together."

The timing is tied to a shift in how flaws come to light. AI-assisted scanning is surfacing potential vulnerabilities at a volume that manual processes were never sized for, and every candidate finding adds work for the maintainers and security teams who must confirm it, correct it and roll the patch out. Akrites casts the situation as one of coordination rather than raw discovery.

Who has signed up

The public letter lists, per dev.to, cloud and software vendors such as AWS, Google, Microsoft, Cisco, IBM, NVIDIA and Red Hat; AI and developer-security companies including Anthropic, OpenAI, Chainguard and Endor Labs; and organizations that depend on software supply chains, including Citi, JPMorganChase and Vodafone. GitHub, Sonatype and Zscaler also appear, alongside the Rust Foundation.

Open-source foundations named in the letter include the Cloud Native Computing Foundation, OpenInfra Foundation, OpenJS Foundation, LF Energy, OpenSSF and the PyTorch Foundation.

dev.to counts roughly 25 to 30 organizations on the displayed letter and notes that this is not a coalition of more than 100 signatories. It also describes the scope as deliberately narrow: Akrites targets critical open-source software specifically, not a broad regulatory or cross-sector cyber-defense agenda.

Fixes, not findings, as the metric

The initiative's defining stance, according to dev.to, is where it places success. Rather than measuring progress by the number of vulnerabilities found or reports generated, Akrites points to whether fixes land upstream in the affected projects and whether downstream users actually deploy the patches.

That framing responds directly to the AI dynamic. When automated tools multiply the volume of reports, the bottleneck shifts to validation, triage, remediation and deployment — stages that rely on human attention and do not scale the way scanning does. A discovery has limited value if a maintainer cannot act on it, if the correction never reaches the upstream codebase, or if users never install the fix.

What it is not

Based on the public letter, Akrites does not announce a commercial security product, a pricing model or a mandatory compliance framework. It is an alignment exercise: an attempt to get vendors, foundations and large consumers of open source working on the operational stages that follow discovery, with those stages treated as the real measure of defense.

Why it matters

Most modern software stacks rest on open-source components maintained by small teams, and AI-driven scanning is set to increase the number of reports aimed at those teams faster than their capacity to respond. An initiative that concentrates attention on upstream remediation and patch adoption targets the part of the pipeline where risk is actually reduced, rather than the part where it is merely catalogued.

For engineering organizations, the practical takeaway mirrors Akrites' stated priorities: check whether findings are validated before they generate remediation work, confirm there is a workable path to upstream fixes for open-source dependencies, assign clear ownership for assessing and deploying patches, and track resolved and deployed fixes as the headline metric instead of raw alert counts.

The open question is execution. The letter signals intent and assembles a credible set of participants, but whether Akrites produces concrete mechanisms — funding for maintainers, shared tooling, coordinated disclosure processes — will determine whether it changes outcomes for the critical projects it aims to defend.