Open Source Security in the Age of AI
AI is accelerating the discovery of open-source vulnerabilities, but finding flaws is only the beginning. Remediating, testing, validating, and deploying fixes safely across critical infrastructure is where the real bottleneck lies, and securing open source at AI speed requires upstream contributions and coordinated efforts like Lightwell and Akrites.
Roughly 90% of the code in a modern enterprise is open source, and it underpins banks, hospitals, power grids, telecoms, cloud platforms, and the AI services people use every day. Much of it was written by small volunteer teams building global infrastructure. That model works well for innovation but scales poorly for time-sensitive maintenance and security. For years, organizations have consumed open source far faster than they have invested in securing it. Because everything is now interconnected, a flaw in one obscure library ripples into thousands of downstream applications.
AI Is Compressing the Time to Find Vulnerabilities
Work that once took a skilled researcher weeks can now happen in minutes. Anthropic’s Project Glasswing reportedly identified 2,300 vulnerabilities across 400 open-source projects, including one bug that had sat in an open-source operating system for 27 years, unnoticed until AI found it. Discovery is now far outpacing traditional remediation. The uncomfortable reality is that attackers have access to comparable discovery capabilities, so the bottleneck has moved. The race is no longer about finding the flaw; it is about what happens after.
Why Fixing Is the Hard Part
Finding a vulnerability is now relatively easy. Fixing it safely is not. Once a flaw is known, teams must determine which versions are affected, map dependencies across components, and assess business impact. Would deploying the fix take a system down, or land at a sensitive point in the business cycle? Then comes building the fix, regression testing to confirm it broke nothing else, validating compatibility across every system it will touch, and deploying into production without disruption. Upgrading to the latest version is rarely realistic. Dependency conflicts, regulatory constraints, and custom code layered on top often mean teams need a tailored backport or a validated alternative rather than the textbook answer. That requires real engineering judgment. AI can assist, but it cannot fully replace a skilled software engineer.
More vulnerabilities found is only beneficial if remediation can keep pace. Without that, additional discovery simply adds to the backlog and can make the ecosystem less safe.
Fixing Upstream
Trust starts at the source. Open source projects carry years of architectural decisions and institutional knowledge that cannot be inferred from the code alone. Human maintainers are essential for confirming that a fix does not break something else, anticipating second-order effects, and keeping projects stable over the long haul. A remediation contributed upstream, rather than kept in a private fork, strengthens the ecosystem for everyone, while isolated forks fragment it.
No single company can secure open source alone. Doing so takes a coordinated effort across AI providers, software vendors, cloud platforms, security firms, maintainers, and nonprofit foundations. Two such efforts are Lightwell and Akrites. Lightwell focuses on identifying, validating, and engineering remediations for vulnerabilities affecting enterprise environments, and contributing those fixes upstream where possible. Akrites addresses the complementary half: coordinated discovery, maintainer engagement, and reducing duplicated effort. Together they aim to connect the full pipeline of discovery, remediation, validation, disclosure, and deployment into one coordinated workflow instead of isolated efforts.
How Lightwell Works
Lightwell’s process moves in stages. It discovers vulnerabilities in open-source software, including components buried deep in an organization’s application stack. AI then analyzes the flaw and the affected code to determine what the vulnerability does, how it can be exploited, and what must change. Rather than forcing customers onto a completely new release, the fix is often backported to the version they already run. Proposed patches are not trusted automatically. AI-assisted development is paired with engineering review and testing to ensure the fix addresses the vulnerability without introducing new problems. Validated remediations are then made available through Lightwell’s trusted software repositories, so organizations can fold them into existing deployment and patching processes. Finally, the fix goes upstream, so it benefits everyone using that software rather than remaining a private patch.
How Akrites Coordinates
Akrites is described as a shared security incident response team. It gives critical infrastructure stakeholders a confidential, structured place to coordinate vulnerability discovery, remediation, and disclosure across the open-source projects they depend on. Because attackers now operate at AI speed, the response has to match. Every finding follows the same path, which gives upstream maintainers one predictable partner and ensures consistent embargo handling. The process moves through intake, duplication and validation, remediation, and synchronized disclosure, offering an expedited route for everyone to benefit from more secure software.
The Real Takeaway
The future of open-source security will not be decided by who finds the most vulnerabilities, since AI has made discovery the easier part. It will be decided by who can remediate the ecosystem safely, responsibly, and at scale. Efforts like Lightwell and Akrites are built to handle the volume and velocity of finding and fixing bugs across the codebases everyone depends on. The good guys now have some powerful new tools on their side, and organizations should use them to improve security at scale.