Coordinated vulnerability disclosure (CVD)

The process by which a flaw goes from “someone knows” to “everyone’s patched” without the interval being useful to an attacker: report privately, validate, fix, coordinate the release, then disclose. The third layer of defensive-security and the only one that is fundamentally a multi-party process problem rather than a technical one.

Why the interval is the asset

Between discovery and universal deployment of a fix there is a window in which the vulnerability is known but not closed. Everything CVD does is about that window: keeping the circle of knowers small, getting a validated patch to the maintainer before news of the flaw travels, and synchronizing release across everyone who ships the affected code. Each additional party holding an unpatched secret raises the chance it leaks early — so duplication of reports is itself a security problem, which is counter-intuitive until you see it stated.

What AI did to it

The Akrites launch is the corpus’s evidence that the window is closing from the discovery end: models can surface vulnerabilities in widely used software “in minutes rather than weeks.” That cuts both ways — defenders get the same tools — but the defender’s side of the exchange is slower by construction, because finding is a machine task while fixing, reviewing, and shipping across an ecosystem is a human, multi-organization one. The asymmetry isn’t discovery vs. discovery, it’s discovery vs. coordination.

The institutional answer

Rather than another scanner, the response has been an operational response layer: a shared Security Incident Response Team as a single coordination point, standard CVD workflow, private cross-organization validation, and embargoed synchronized patching before public disclosure. The Linux Foundation-hosted Akrites is the instance this hub tracks — paged in full over in ../ai-governance-wiki, which owns it as a governance modality (competitors pooling vulnerability response under a neutral venue). Here it matters as the practice: what a defender’s disclosure process should look like when discovery is cheap.

The unsourced half

CVD’s hard cases are all in what the founding source doesn’t cover: unmaintained projects with no one to receive a report, disclosure deadlines when a maintainer doesn’t respond, and the researcher-side ethics of publishing when a vendor stalls. Worth sources on all three.

A live case, under maximally embarrassing conditions (2026-07-29)

openai-huggingface-incident is the corpus’s first end-to-end worked example, and the disclosure behaved better than the engineering did. Hugging Face published within days of detection without knowing who had attacked them; OpenAI self-identified publicly five days later rather than staying silent; the zero-day the models exploited in a third-party package-registry proxy was responsibly disclosed to that vendor; and the two companies announced joint remediation.

Nothing compelled the confession — the attacker’s identity was genuinely unknown at the time of the victim’s disclosure. That the perpetrator came forward anyway is a data point on whether CVD norms hold when the disclosing party is the one at fault and the story is humiliating. One case is not a trend, but this spoke’s founding question about multi-party coordination now has an instance where the parties were the vendor, the victim, and an unrelated proxy vendor, and the chain held.

akrites-oss-ai-threats · defensive-security · akrites · linux-foundation · openai-huggingface-incident