Akrites aims to filter AI security noise for open source maintainers

AI reports are flooding maintainers

Open source maintainers are being inundated with security reports produced by AI tools that are inaccurate, duplicative and short on the detail needed to write a patch, according to Christopher Robinson, CTO of Akrites and chief security architect at the Open Source Security Foundation, and Laura Guazzelli, the Linux Foundation's security architect for AI and agentic systems. Speaking at Open Source Summit Europe in Prague, Robinson said AI has lowered the barrier to entry for vulnerability hunting, leading to a flood of probes from people without security credentials.

The two spoke after a related conference talk in which OpenSSF chief of staff Adrianne Marcum half jokingly used the term "vibe researching" for the growing use of AI to hunt bugs. Robinson estimated that reviewing a single security pull request can take an engineer up to eight hours. He described the reports as verbose, highly inaccurate and inclined to overestimate severity, while Guazzelli said models often miss wider security controls that can render a reported issue harmless.

A shared response layer

Akrites, an initiative announced by the Linux Foundation in June, is trying to act as a shared security incident response team. It consolidates vulnerability reports, validates findings and coordinates fixes with upstream maintainers. Robinson said Akrites uses AI to assess incoming reports and find duplicates, while seconded engineers add human review before material reaches project maintainers.

Founding members include Anthropic, OpenAI, Google, Microsoft, AWS, NVIDIA, Cisco, IBM, Red Hat, Citi and JPMorganChase, among others. Robinson said members are expected to contribute engineering resources, up to 10 full time engineers each, and some financial institutions provide more money instead because internal policy prevents them from contributing upstream. He put the fleet at about 200 seconded engineers and said the goal is to make reports more concise and understandable, with test cases, proof of concept and patches.

Funding and ownership

Akrites is not the only Linux Foundation effort using AI for open source security. The open source Cyber Reasoning System, or OSS CRS, is developing AI powered tools that projects can use to investigate vulnerabilities and generate fixes. Guazzelli said the aim is not only to confirm a vulnerability but to deliver the best patch possible without introducing new vulnerabilities or breaking existing functionality.

Robinson said the work is expensive because it is highly powered and enabled by LLMs, with costs covering infrastructure and tokens. He said corporate members provide the financial backing and stressed that open source maintainers should not carry the cost alone. With a backlog of hundreds of thousands of reports, he said commercial organizations are welcome to take the patches, but the fixes should reach upstream projects rather than stay isolated.

Sources: The New Stack