Time to start praying to the goddess of wisdom and war:
It's going to be a "messy" summer for security folks, especially when it comes to fixing the open source code that underpins their organizations.
That's according to Dan Lorenc, CEO and co-founder of Chainguard, a software supply-chain security company leading Athena, a newly formed coalition of about two dozen companies that wants to make the process of finding and fixing open source bugs "as easy to consume as possible."
The members have committed to using AI to prevent attacks on open source software. In addition to Chainguard, other founding member companies include BNY, Cisco, Cloudflare, Corridor, DepthFirst, Docker, JPMorganChase, Kyndryl, LTM, and PwC.
Many of these member companies are also partners with Anthropic's Project Glasswing and OpenAI Daybreak, which allow them to try out the pair's most advanced bug-hunting models. The coalition accepts vulnerability findings generated by all frontier models, according to Lorenc.
Athena has already processed more than 20,000 findings and developed over 2,000 patches across 500 open source projects.
In about three weeks, the coalition's first wave of bug disclosures will begin.
"This is going to be a messy summer for everyone," Lorenc told The Register in a phone interview.
[...] "Put yourself in the shoes of someone with Glasswing access," he said. "You get this crazy, new model that can find vulnerabilities everywhere, that no one had seen and you had missed for years with all of your other tooling. You run it on your code, and it finds tons of stuff in your first-party code, the stuff that you've written, and you fix all of that."
After running Mythos Preview on all of your organization's proprietary code, imagine pointing the model at an application. Most modern apps contain a mixture of code from different sources, mostly third-party. According to Lorenc, 95 percent of the code in any of these codebases is open source.
"When you run [advanced models] at the application level, you find a ton of vulnerabilities in open source code that you can't fix for yourself the same way you can that first-party code," Lorenc said. "So then you're left with: what to do?"
[...] The only guarantee in the entire disclosure process is that attackers are moving quickly and the time to exploit – that's the time between a CVE's public disclosure and first confirmed in-the-wild exploitation – has essentially collapsed.
[...] "It's a super awkward, strange world and timeline we are all living in," Lorenc said. "There's a ton of pressure because all of the frontier models are getting better, and the open models are getting better, and they're going to be able to start discovering these at the same time, too. So, that's what we're trying to help with: to be that clearinghouse for critical industry."
Athena coalition members submit vulnerabilities they find in open source code using any frontier model. Sometimes they find these bugs while scanning their own apps. In other cases they discover them after pointing Mythos or GPT‑5.5‑Cyber at a commonly used library, Lorenc said.
The companies submit a full report to Chainguard, which acts as a clearinghouse, deduplicating, correlating, and addressing findings from members in batches across entire libraries, hardening them against classes of vulnerabilities instead of just one bug.
Affected projects are rebuilt as private, hardened versions available to Athena members through Chainguard Libraries before vulnerabilities are publicly disclosed – and hopefully addressed upstream – a month later. For maintainers that can't make a permanent fix, Athena acts as a "maintainer of last resort," according to Lorenc.
On Thursday, the Linux Foundation joined the effort and announced Akrites, an industry coalition to defend open source software against AI-enabled threats, by finding and fixing vulnerabilities. Akrites establishes a shared Security Incident Response Team (SIRT) and a standardized Coordinated Vulnerability Disclosure (CVD) process.
Founding companies include Amazon Web Services, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM, JPMorganChase, Microsoft and GitHub, Nvidia, OpenAI, RapidFort, Red Hat, Rust Foundation, Sonatype, Vodafone, and Zscaler.
"As AI finds more vulnerabilities, the industry will rush to patch them. Without coordination, those fixes will fragment across different patches and forks, and maintainers who are already overwhelmed, unreachable, or haven't touched a project in years," Lorenc said, adding that Akrites provides a coordinated way to fix flaws upstream before criminals exploit them.
Plus having a dedicated SIRT gives maintainers a single partner - and disclosure -to work with on remediation instead of a hundred uncoordinated reports.
"Now the work is making sure there's always someone on the other end to catch them," Lorenc said.
(Score: 2, Interesting) by Anonymous Coward on Sunday July 05, @02:46PM
But say your server is written in perl/python some buffer overflow will just get you a DoS not a "attacker runs arbitrary code of the attacker's choice".
BTW why is java log4j so full of security issues? It's so bad that it seems almost on purpose or something.
(Score: 5, Insightful) by JoeMerchant on Sunday July 05, @03:41PM
The thing that worries me most is that the flurry of updates to address recently identified minor vulnerabilities will, unintentionally in combination, create more serious vulnerabilities which become more complicated to address than simply updating an isolated package.
🌻🌻🌻🌻✌️ [google.com]
(Score: 3, Insightful) by bloodnok on Sunday July 05, @07:26PM (2 children)
I want to see an AI security analysis model that works in meatspace.
Maybe they can persuade the MBAs and PHBs that many of their so-called security policies are counter-productive or worse.
Can we stop this nonsense of insisting that passwords have special characters and such.
Can we ensure that 2 factor authentication is truly 2-factor - I don't record passwords to most sites since all I need to get in is to press the "forgot password" button (aka the 1-factor authentication button).
Can we have AI monitors in banks and financial institutions equipped with face-slapping robots to deal with those staff that send out sensitive private information by email.
Can we have them also slap those that call pictures of computer-generated text "digital signatures".
What other meatspace "security practices" need to be exposed as inadequate, useless, or potentially harmful?
__
The major
(Score: 4, Interesting) by JoeMerchant on Sunday July 05, @07:55PM
>Can we stop this nonsense of insisting that passwords have special characters and such.
NIST finally saw the light a couple of years ago: https://pages.nist.gov/800-63-4/sp800-63b.html#complexity [nist.gov] I predict it will take decades for this "best practice guidance" to roll out into actual use within our own IT systems. Some readings of the new guidance are upping the length requirement from 8 characters to 15 (in situations which do not use MFA), but they clearly say that upper-lower-numeric-special requirements are counterproductive and should be dropped.
🌻🌻🌻🌻✌️ [google.com]
(Score: 3, Informative) by JoeMerchant on Sunday July 05, @07:59PM
> the "forgot password" button (aka the 1-factor authentication button).
Instagram / Meta: leading the world in embarassing system flaws
https://securityboulevard.com/2026/06/instagram-password-reset-flow-raises-concerns-over-potential-user-phone-data-exposure/ [securityboulevard.com]
🌻🌻🌻🌻✌️ [google.com]
(Score: 0) by Anonymous Coward on Tuesday July 07, @07:01AM
They say it almost as if open source is a bad thing.
You or someone you hire can try to fix the more urgent stuff (with AI or without) and ask a bunch of AIs to check the results. Repeat rinse. You don't have to change the entire code.
Even if an exploit is introduced that way, if it was not spotted by the bunch of AIs and you, the attacker might not spot or exploit it either in the time gap between your fix and the official fix.
Lot harder to fix closed/no source code.
I suggest the difficulty gap between using AIs to find exploits in binaries vs using AIs to fix those binaries is much greater than using AIs to find exploits in OSS and using AIs to fix OSS.
FWIW I'm not a OSS fanboy. I use both Windows and Linux.
I also use AI to help write some code. It gets stuff wrong, it gets stuff right. So it can be useful.