Akrites Explained: Open Source's New Emergency Team  🔗 **Source:** [Akrites Explained: Open Source's New Emergency Team](https://www.youtube.com/watch?v=Pbgc4PtEIIA#transcript) So, the Linux Foundation recently launched a new initiative called Acrties. And if you only skim the headline, you probably filed it under another security consortium, whatever. But, don't do that because this one really matters, and the reason it's got almost nothing to do with the press release. You see, everyone's framing Acrties as a governance story, but it's really much more than that. It's really a response to the fact that AI has quietly broken open source security in a way that most people have not clocked yet. And I spent my whole career working with open source foundations and the companies that fund them. So, in this video, I'm going to walk through what Acrties is, how it's designed to help, why the Linux Foundation is the one organization on the planet with a genuine shot at pulling it off, and the one detail in the launch that tells you whether it's going to work or fizzle. >> [music] >> But, let's start out with the problem because the shape of the problem really tells you why Acrties looks the way it does. You see, in April 2026, Anthropic announced a new frontier model called Claude 3 Opus Preview, which when applied to open source software, surfaced over 10,000 high or critical severity vulnerabilities. These are exploitable serious bugs in the software your bank, your hospital, and your power grid run on. Now, a month in, Anthropic published its first progress update, and the numbers told a pretty scary story. It reported 530 findings assessed as high or critical to open source maintainers, and about 75 of them were known to be patched. That's about one in seven. Anthropic cautioned that the figure was probably an undercount, but either way, several maintainers had asked Anthropic to slow down because they lacked the capacity to design and ship fixes quickly enough. And it gets much worse than just pure raw volume because it isn't just Anthropic doing the scanning here, right? It's every cloud provider, every security vendor, or end users. They can all point a model at the same packages, which means that a popular library can receive the same vulnerability described five different ways by five different reporters in a single week. This means that maintainers drown trying to separate real exploitable findings from purely confident AI noise. And some maintainers have even started ignoring AI-generated reports entirely, which means the real ones get missed, too. And when everyone scans independently, everyone races each other to disclosure, and every additional party who knows about an unpacked bug, well, that raises the odds that it leaks before the fix exists. Essentially, AI now finds security holes at machine speed, but humans patch them at human speed, and the delta between those two speeds is where every attacker on Earth is going to live for the next decade. And that's the [music] gap that the cretes exist to close. Now, a quick aside on the name first, because I think it's kind of cool. The cretes were the Byzantine Empire's frontier guards, the people standing watch where threats arrive first, and the defenses were thinnest. In modern software, that frontier is upstream software, the open source projects that everything else sits on. And the root of that word is the same one that gives us critical, which is exactly the software this thing exists to defend. So, a cretes is part of the Linux Foundation, and it's built specifically to coordinate open source security response in the AI era. You can think of it as basically three practical things bolted together. Now, firstly, it's a shared security incident response team, a cert, that sits above individual projects. You see, when AI-scale vulnerability discovery lands, the cert validates it. They deduplicate it. They merge those five versions of the same bug into one case. They validate severity. They assign ownership. And then they coordinate the fix. From the maintainer side, that's one predictable front door running one standardized process instead of 100 independent reporters. Nobody sat there triaging alone at midnight. Secondly, a cretes has a genuinely confidential coordinated disclosure process, and the design here is stricter than you might expect. Every finding is TLP red from the moment of intake. That basically means it's visible only to the case team. The analysis and patch work happens inside isolated secure enclaves. Access is gated by the traffic light protocol at every phase of a case, and every member has to sign a participation agreement and an NDA. Disclosure is basically synchronized. Every upstream enters the same disclosure window. The embargo covers all parties and artifacts until the moment of public disclosure, and the fix publishes into the packages original namespace when it lifts. Now, the Linux Foundation has been very explicit about the founding logic here. This is all about preventing vulnerabilities being weaponized before patches are delivered. And thirdly, membership is all about contribution. Founding members commit engineering talent, security expertise, and funding, and the foundation's open invitation is to organizations that want to contribute engineering resources or funding to the security of critical open source projects. Essentially, the dues that are raised by Acrties will fund the neutral cert and the secure infrastructure that it's going to run on, not any single company's agenda. And there's one more detail that's worth knowing here because it answers a concern that a lot of people have when it comes to open source. What about critical packages with no active maintainer at all? And there are more of those than you might think. Well, Acrties is explicitly designed to act as a maintainer of last resort, so that fixes can still be delivered for widely used packages that nobody maintains anymore. So, for the first time someone actually has the standing to ship a fix when there's no upstream left to ship it. In plain terms, Acrties basically turns what used to be a lone volunteer with an inbox full of CVEs into a coordinated team with a process, funding, and confidential channels to the companies whose products depend on that code. That's the help, and that's what's on offer. So, the big question is here, could this work? Like, is this going to work? Is Acrties going to be a success? Because you would be right to have some skepticism about this. There's loads of security coalitions that have been formed over the years with a lot of fun fair who basically deliver a PDF. But, the reason to take this one seriously is that the Linux Foundation has pulled this exact move off before, twice. The first time was Kubernetes. In 2015, Google did something kind of unusual for a tech giant. Instead of hoarding Kubernetes as a Google product, they donated it to a brand new Linux Foundation subproject called the CNCF, the Cloud Native Computing Foundation. Neutral ground, neutral governance. Within a few years, Red Hat, IBM, Intel, VMware, and roughly every enterprise vendor with a pulse were co-investing in the same project. The CNCF now hosts over 200 projects and hundreds of thousands of contributors, and KubeCon is basically the biggest cloud infrastructure event of the year. That didn't happen because the code was magic. It happened because the governance was credibly neutral, and companies that would rather stab each other in a parking lot were willing to sit at the same table and write checks. And the second time is happening right now in security specifically, and it's called Alpha Omega. Since it launched in 2022, Alpha Omega's quietly distributed over $20 million across more than 70 grants, and it's embedded security staff in critical ecosystems like Node.js and PyPI. In 2025 alone, the work of Alpha Omega fixed 52 vulnerabilities in critical projects. And then in March 2026, a fresh $12.5 million landed from Anthropic, AWS, GitHub, Google, [music] Microsoft, and OpenAI together in the same fund. In an industry where these companies won't agree on what day it is. And this is the Linux Foundation's real superpower, and it's kind of [music] rare. They create the environment where competitors co-invest in shared infrastructure without any single one of them being in charge, which means that Accrete is not just some random new logo. It's the next story in a building that the Linux Foundation has been putting up for years. Alpha Omega handled the funding, the OpenSSF handled the standards, projects like Glasswing out there handled the finding, but Accrete is handles the piece that nobody owned, which is coordinating the disclosure and remediation of what gets found at AI scale. And by its own description, it's built to accept and coordinate reports from external finders like Glasswing. So, from my vantage point, the plumbing already exists, and that's what makes this attempt structurally different from the coalitions that came before it. But let me steel man the skeptical view here because the honest critique of Accrete is goes something like this. Large multi-stakeholder coalitions have a long, unglamorous history of producing beautifully designed governance documents and very little working code. So, a skeptic asks, fairly, what makes a CISA different [music] from every previous coalition to secure open source that came before it? And there's a second version of the same critique that goes a little bit deeper. If AI finds bugs faster than humans can fix them, no amount of foundation building fixes the underlying maintainer capacity problem. Coordination without engineers is just, well, tidier chaos. Now, both of these concerns are real. But, let me explain to you why I think this is going to work. You see, a CISA is operationally much more specific than what came before it. It's not another manifesto. It's a CERT, a confidential disclosure process with real information handling rules, a maintainer of last resort answer for packages with no maintainer at all, and a membership model built on contributing engineering or funding it. That's a different animal from, "We all agree security is important. Here's a working group." You see, coordination genuinely does reduce duplicated work, and when the same bug is being reported five times to five overwhelmed maintainers, cutting that to one triaged, validated report with a suggested fix is a real efficiency gain, even without adding head counts. And then you stack the funding on top. Alpha Omega already proved that when the Linux Foundation converts corporate checks into embedded security engineers, real vulnerabilities actually get fixed. A CISA [music] inherits that muscle, not from scratch, but from a multi-year operational base. And finally, let's be honest, the urgency is way different this time. The Glass Wing data has changed the political calculus inside of every major AI lab and cloud provider. Nobody wants to be the company whose model discovered the CVE that took down a hospital because there was no one to coordinate the fix. That fear is doing more work than any press release could. All of this is to say, this is early days. The CISA is only announced fairly recently, but the structural pieces look right to me. The track record of the Linux Foundation is very real, and the incentives, I think, are pretty aligned. But, the proof is going to come from the work and not the launch. And the Linux Foundation itself has said that the success of this effort will be measured in patch deployment and not publication. So, you kind of need to hold them to that. I suggest you watch this, not the founding members list, not the next press release. Watch whether a cretes can stand up the shed certain take real triage work of maintenance plates in the next year. If they can do that, this becomes the security backbone of the AI era. If they can't, well, it becomes another very well-funded PDF. Now, before I wrap up this video, just one more thing I want to say. Every time a technology genuinely changes the infrastructure layer, >> [music] >> the market eventually figures out that no single company gets to own the response. It went that way with the internet, it went that way with Linux, it went that way with cloud native. >> [music] >> And it's now going that way with AI security. And the Linux Foundation, from my vantage point, has a pretty solid track record of getting competitors to actually sit down together and build the thing. And a cretes is their next attempt at doing this. So, the frontier guys have their backs against the wall, and I, for one, I'm going to be paying attention to what happens next. >> [music], Akrites Explained: Open Source's New Emergency Team, YouTube, 01ky2m3h94e8f4sxke0gg2arj8.