InfoQ: Linux Foundation launches Akrites (2026-07-10)

InfoQ’s report on the Linux Foundation launching Akrites, an industry body for finding, fixing and disclosing vulnerabilities in critical open-source software before attackers reach them. 20+ founding organizations: AWS, Anthropic, Google, Microsoft, OpenAI, NVIDIA, IBM, Red Hat, Cisco, Chainguard, Sonatype, plus global financial institutions.

The premise

“AI models can now discover vulnerabilities in widely used software in minutes rather than weeks, dramatically shrinking the window between discovery and exploitation.” That sentence is the whole argument for the body’s existence and the reason coordinated-vulnerability-disclosure is a live subject rather than a settled process.

What it actually adds

Not another scanner — an operational response layer: a shared SIRT, standardized CVD processes, private cross-organization validation, and synchronized patching before public disclosure. InfoQ positions it as complementing rather than replacing OpenSSF and Alpha-Omega, which do standards and tooling; Akrites does coordination and remediation.

Second source on an already-paged subject

Akrites is paged in full in ../ai-governance-wiki (akrites, from a June 2026 New Stack piece), which owns it as a governance modality — competitors pooling vulnerability response under a neutral foundation — with the membership tiers, the >$7M/yr Alpha-Omega seed funding, and named quotes this article lacks. Nothing here contradicts that page; this one is thinner and adds no facts it doesn’t already carry. It’s ingested here for the practice it exemplifies rather than the institution, and the institution stays a cross-wiki link rather than a duplicate node.

Worth being explicit about the consequence: of this spoke’s three founding sources, this is the one whose subject was already covered elsewhere. The gap it fills is that no spoke owned CVD as a defensive practice — which is a real gap, and a narrower one than “no spoke owns Akrites.”

Related

coordinated-vulnerability-disclosure · defensive-security · akrites · linux-foundation