An Open Letter on Akrites, a Joint Effort to Protect Open Source Security

As AI technology advances, the speed at which software vulnerabilities are discovered has increased dramatically, reaching a level that existing open-source maintenance practices can no longer handle. In response, Akrites has launched, with participation from global IT companies including Amazon Web Services, Anthropic, Google, Microsoft, OpenAI, NVIDIA.

Akrites has the following core goals:

• Unified security response: Instead of the fragmented security scanning and reporting practices that multiple companies used to carry out individually, vulnerabilities are found and fixed through a single, trusted channel.
• Upstream-focused fixes: When a vulnerability is found, it is proactively fixed at the source code level (upstream) before a patch is distributed, preventing attackers from reverse-engineering patches to build attack tools.
• Maintenance support: For core open-source projects without maintainers, Akrites acts as a maintainer of last resort to fill the security gap.
• Protection of sensitive information: The process from discovery to patch application is strictly managed so that fixes can be completed before a vulnerability is disclosed and weaponized.