Loading story…
Chainguard announced Athena, an industry coalition built to protect open-source software from vulnerabilities discovered or accelerated by frontier AI systems. The initiative operates as a private vulnerability intelligence-sharing and coordinated remediation platform, allowing members to submit findings confidentially while Chainguard works with maintainers to patch affected projects and partners prepare mitigations and detections before public disclosure.
Founding participants include BNY, Cisco, Cloudflare, Docker, and JPMorganChase, reflecting support from technology, financial, and consulting sectors. Chainguard said Athena is already operational and has processed more than 20,000 findings, delivered over 2,000 patches, and supported fixes across roughly 500 open-source projects, with the coalition expected to begin its first public disclosures after members complete coordinated response efforts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
At launch, Chainguard said Athena was already operational and had processed more than 20,000 findings. The company also said the coalition had shipped more than 2,000 patches across 500 open-source projects through its coordinated remediation model.
On June 16, Chainguard announced Athena, an industry coalition and vulnerability intelligence-sharing platform intended to protect open-source software from vulnerabilities discovered or accelerated by frontier AI systems. Founding members named in the reporting include BNY, Chainguard, Cisco, Cloudflare, Corridor, DepthFirst, Docker, JPMorganChase, Kyndryl, LTIMindtree, and PwC.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AI-assisted vulnerability discovery is driving a sharp rise in open source security findings, straining the systems used to validate, disclose, and remediate flaws. Chainguard said its Athena coalition has already processed more than **20,000** AI-generated findings and helped produce over **2,000 patches** across **500 projects**, while Anthropic previously estimated its tooling uncovered **6,202** high- or critical-severity issues in more than 1,000 open source projects. The Linux Foundation has also launched **Akrites**, a coalition with a shared incident response capability and standardized coordinated disclosure process to help the ecosystem manage AI-enabled vulnerability discovery. GitHub said the resulting volume has pushed its Advisory Database to record levels, with **1,560** reviewed advisories published in May 2026 and more than **6,000** advisory decisions processed per month from March through May, yet incoming private reports, repository advisories, and CVE requests still outpaced review capacity. The company said reviewed advisories remain human-validated and Dependabot alerts continue to function normally, but publication timelines for many new advisories have stretched from roughly a week to several weeks as analysts handle package disambiguation, version-range reconstruction, multi-ecosystem verification, and conflicting upstream data; GitHub is responding with improved triage, expanded backend capacity, automation, AI-assisted research tools, and guidance for researchers to submit more complete reports and request CVEs only when publication is intended.
Jul 12, 2026
The Linux Foundation and a coalition of major technology and financial firms have launched **Akrites**, a new initiative designed to protect critical open-source software as AI accelerates vulnerability discovery and exploitation risks. Backers include Amazon Web Services, Anthropic, Cisco, Citi, Ericsson, Google, IBM, JPMorganChase, Microsoft, GitHub, Nvidia, OpenAI, Red Hat, and the Rust Foundation, reflecting broad industry concern over the security of widely used open-source components. Akrites is intended to streamline coordinated vulnerability disclosure and remediation by providing a shared security incident response capability for critical projects. The effort aims to reduce fragmented reporting, duplicate submissions, conflicting fixes, and pressure on already overburdened maintainers, while improving how serious flaws are disclosed and patched across the open-source ecosystem. Early reaction has framed the program as a significant step toward collective defense, though its effectiveness is expected to depend on scaling response capacity, avoiding centralized bottlenecks, and earning the trust of project maintainers.
Aug 4, 2026
NVIDIA, Palantir, Hugging Face, Microsoft, Adobe, IBM, Red Hat, SpaceX and other partners have launched the **Open Secure AI Alliance**, a 33-member industry effort aimed at improving the security of open-source software and open-weight AI models. The group said it will develop open techniques and tools for faster vulnerability identification, disclosure, and patching, while building on existing work from the Linux Foundation's Akrites initiative and **OpenSSF**. Organizers said the push reflects growing concern that defenders need AI systems they can inspect and run on their own infrastructure, citing lessons from the recent Hugging Face security incident. The alliance is also positioning AI security beyond model behavior alone, emphasizing infrastructure risks such as provenance, identity, deployment accountability, and secure data pipelines. NVIDIA argued that open models and open harnesses can improve transparency, incident response, and shared remediation, and pointed to its open-source **NVIDIA Labs Object-Oriented Agent (NOOA)** project as a contribution for testing, tracing, auditing, and governance of AI agents. Supporters said the initiative could help establish common standards for securing AI infrastructure, though some observers criticized its largely U.S.-centric membership and called for broader international participation.
Aug 11, 2026