Endor Labs CEO Varun Badhwar went further: Of the thousands of validated open-source vulnerabilities AI has surfaced in recent months, "fewer than 5% have been patched."
Akrites replaces that process with a single, confidential Security Incident Response Team—one predictable partner for maintainers rather than a flood of uncoordinated reports. Fixes return to each project's original repository on maintainers' terms, using standards for vulnerability tracking. When a critical package has no active maintainer, Akrites commits to stepping in as maintainer of last resort.
The program was built first to prevent leaks—the open letter called an undisclosed flaw in a widely deployed package "a weapon." Rust Foundation CEO Rebecca Rumbul said the goodwill of open-source maintainers has for too long been taken for granted and this initiative will help them work in coordination.
“Akrites promises meaningful coordination with upstream maintainers, financial, and full-time support to find, fix and disclose security vulnerabilities responsibly, and a genuine commitment from the most influential companies across tech and finance to solve this problem,” she said.
JPMorganChase CISO Pat Opet outlined what success actually requires for the effort. "AI has massively compressed the time between vulnerability discovery and exploitation to near real time," Opet said—meaning adversaries can reverse-engineer a published patch and build a working exploit before many downstream systems have deployed the fix.
Success, per Opet, is "patch deployment, not patch publication."
Though similar, the two efforts differ in scope: Patch the Planet focuses on AI-assisted discovery and patch delivery with expert human review; Akrites builds the coordination layer that routes validated findings upstream across the industry.
Alpha-Omega, a Linux Foundation directed fund, will provide seed funding for Akrites. The fund has issued over 70 grants totaling more than $20 million to open-source security projects since 2022. Other organizations can join by contributing engineering resources or funding at akrites.org.
