← Back to feed

The open-source software stack underpinning most of the internet carries a security debt that volunteer maintainers cannot audit fast enough. Two announcements this week attempt to change the equation by pairing AI-scale vulnerability discovery with the infrastructure needed to handle the output.

OpenAI launched Patch the Planet, an initiative deploying AI agents to identify vulnerabilities in widely-used open-source software and route findings through responsible disclosure channels. The Linux Foundation simultaneously launched Akrites, an industry security project building the shared infrastructure needed to receive, triage, and coordinate disclosure of those reports at scale. The Akrites founding letter — “We All Depend on Open Source. We Will Defend It Together” — is drawing industry signatories at akrites.org.

Why Infrastructure First

The coordination problem is not hypothetical. AI models operating in security contexts already generate vulnerability reports at volumes no existing disclosure ecosystem was designed to handle.

Claude Mythos found 271 Firefox vulnerabilities in a single Mozilla engagement, with near-zero false positives. Microsoft’s 100-agent AI harness found 16 Windows CVEs — including an unauthenticated IKEv2 RCE — in one internal engagement. Glasswing, the AI vulnerability consortium backed by a $104M coalition that includes Amazon, Apple, Google, Microsoft, and NVIDIA, logged more than 10,000 bugs in its first operational month. All of those engagements were proprietary, enterprise-contracted, and bound by commercial disclosure timelines — structures that don’t exist in open source.

Akrites is the attempt to build that structure before AI-generated reports overwhelm OSS maintainers. The project provides standardised reporting formats, coordinated disclosure timelines, and triage channels that let affected projects patch before exploits become public. Without it, a flood of AI-found bugs risks creating disclosure chaos that benefits attackers more than defenders.

What Changes With AI at the Wheel

Traditional responsible disclosure assumes a human researcher files a report, waits for acknowledgement, coordinates a patch window, and publishes. The cadence is measured in days. An AI agent auditing a large codebase can generate hundreds of credible, well-structured reports in hours — faster than any existing OSS security team can triage.

Patch the Planet attempts to direct AI vulnerability capacity at the commons rather than exclusively at enterprise clients paying for proprietary access. The model is closer to a civic deployment than a commercial product: AI finds, Akrites routes, maintainers patch, everyone benefits.

The Open-Source Tension

The shift matters because the open-source software that enterprise AI runs on — language runtimes, libraries, frameworks, container tools — is maintained largely by volunteers without security budgets. Glasswing’s enterprise model worked because telecom operators and banks can absorb coordination overhead. Open-source maintainers cannot.

Whether Akrites can build the governance and tooling fast enough to make AI-assisted OSS security functional rather than chaotic is the real test. The Linux Foundation has a track record with neutral infrastructure coordination — it’s how the CVE ecosystem scaled — but the velocity AI introduces is an order of magnitude beyond anything that system was designed for.

Key Numbers

Engagement	Vulnerabilities Found	Model
Mozilla Firefox	271	Claude Mythos
Microsoft Windows (internal)	16 CVEs	100-agent harness
Glasswing (Month 1)	10,000+	Multi-model

Patch the Planet extends this capacity to public goods. Akrites builds the plumbing to make it useful rather than chaotic.