# Akrites Explained Open Source's New Emergency Team > [!question] Lingering Questions > - What is Akrites' actual founding-member list and initial CERT staffing once published? Check https://www.youtube.com/watch?v=Pbgc4PtEIIA. > - Revisit in ~12 months for real patch-deployment metrics from Akrites, per the presenter's own suggested watch criterion. > [!tip] Article Ideas > - none beyond the fleeting-queue watch items above > [!link] Cross Reference > - [[3. Resources/MOCs/Open Source Governance MOC]] — a new neutral-body governance instance alongside CNCF/Kubernetes and Alpha Omega precedents > - [[3. Resources/Permanent Notes/Maintainer Attention Is the Scarce Resource in Open Source]] — the maintainer-burden problem Akrites is designed to address > [!quote] Vocabulary > - **Akrites** — the Linux Foundation's coordinated open-source security-response body, named after Byzantine frontier guards, built to triage and deduplicate AI-generated vulnerability reports before they reach maintainers ## Bib capsule "Akrites Explained: Open Source's New Emergency Team," (YouTube), 2026 — https://www.youtube.com/watch?v=Pbgc4PtEIIA ## Author's thesis (Adler Q1+Q2) The Linux Foundation launched Akrites, a coordinated security-response body built to handle the flood of open-source vulnerabilities that AI-driven scanning tools now surface faster than maintainers can patch them. In April 2026, Anthropic's model-driven scan of open-source software surfaced over 10,000 high/critical severity findings; a month later only about one in seven of the 530 reported to maintainers had a confirmed patch, and some maintainers asked the scanning to slow down. The presenter argues Akrites' governance and confidentiality design look more operationally specific than prior industry coalitions, citing Linux Foundation precedent (CNCF/Kubernetes, Alpha Omega) for turning competitor funding into working infrastructure — but the real test is whether success gets measured in patches shipped rather than press coverage. ## Key arguments (≤3) 1. **The core gap is a speed mismatch**, not a detection problem — AI now finds vulnerabilities at machine speed while humans still patch at human speed. 2. **Duplicate AI-generated reports actively degrade maintainer response**, not just add noise — the same bug described five different ways by five reporters causes real alert fatigue and reported cases of maintainers ignoring AI reports outright. 3. **Neutral, foundation-level governance is what lets competitors co-fund shared infrastructure** rather than duplicating it separately — Akrites follows the CNCF/Alpha Omega pattern. ## Claim atoms ### AI scanning outpaces human patch capacity > [!quote] > "AI now finds security holes at machine speed, but humans patch them at human speed." **Where/why**: Mid-video, framing the core problem Akrites exists to solve. The central causal claim of the entire video — everything else is justified as a response to this gap. #xref ### Duplicate AI reports cause maintainer alert fatigue > [!quote] > "A popular library can receive the same vulnerability described five different ways by five different reporters in a single week." **Where/why**: Explains why maintainers reportedly started ignoring AI-generated reports entirely. Directly motivates Akrites' CERT deduplication function. #xref ### Success is measured by patches shipped, not press > [!quote] > "The success of this effort will be measured in patch deployment and not publication." **Where/why**: Presenter cites this as the Linux Foundation's own stated success metric. A concrete, falsifiable benchmark for judging Akrites in a year, rather than judging it by the launch alone. #xref #aphorisms ## Permanent candidates - **Neutral governance converts competitor rivalry into shared infrastructure** — when a neutral third party owns governance of shared infrastructure, direct competitors co-fund and co-build it rather than duplicate it separately. Promoted below. ## Processing checklist - [ ] Track Akrites' founding-member list once published - [ ] Revisit ~Q3 2027 for real patch-deployment metrics - [x] Connect into the relevant MOC — [[3. Resources/MOCs/Open Source Governance MOC]] ## Links - [[3. Resources/MOCs/Open Source Governance MOC]] — a new neutral-body governance instance for security response - [[3. Resources/Readwise/Articles/Akrites Explained Open Source's New Emergency Team]] — source document