{
  "id": 14715744,
  "title": "“Everybody with a $20 account is now a researcher”: How Akrites is tackling the flood of AI bug reports",
  "url": "https://urgent.news/2026/10/15/everybody-with-a-20-account-is-now-a-researcher-how-akrites-is",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-15T14:28:20.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/akrites-ai-vulnerability-reports/"
  },
  "original_language": "en",
  "account": "The increase in AI-generated reports about potential security vulnerabilities in open source software is overwhelming maintainers. An initiative called Akrites, launched by the Linux Foundation in June, aims to tackle this issue. Akrites plans to provide a shared security incident response team to validate findings and coordinate fixes with upstream maintainers. Christopher Robinson, CTO of Akrites and chief security architect at the Open Source Security Foundation, and Laura Guazzelli, the Linux Foundation's security architect for AI and agentic systems, discuss the challenges faced by maintainers and the role of AI in vulnerability hunting.\n\nRobinson emphasizes that AI has lowered the barrier to entry for vulnerability hunting, allowing almost anyone to probe open source codebases. He jokingly describes this as \"vibe researching,\" referring to the surge of AI-generated security reports that require human expertise to separate genuine threats from noise. Reviewing a single security pull request can take an engineer up to eight hours, which could otherwise be spent on other tasks.\n\nGuazzelli points out that AI models may identify suspicious code without understanding the broader security architecture of a project, which could render reported vulnerabilities harmless. They may also flag code as vulnerable without acknowledging existing security measures that prevent exploitation. Furthermore, many AI models find similar bugs, leading to a large number of duplicative reports.\n\nDespite improvements in AI-generated vulnerability reports this year, the benefits are not always reaching open source maintainers. Expensive paid models produce better reports, but these companies may not always share findings with upstream projects. Akrites, with significant backing from industry giants like Anthropic, OpenAI, Google, Microsoft, AWS, NVIDIA, Cisco, IBM, Red Hat, Citi, and JPMorganChase, aims to address these challenges. Members contribute not only financial resources but also engineering expertise, bringing valuable contributions to help maintainers separate genuine threats from noise.",
  "summary": "AI is making it easier than ever to find potential security vulnerabilities in open source software. But finding something that The post “Everybody with a $20 account is now a researcher”: How Akrites is tackling the flood of AI bug reports appeared first on The New Stack .",
  "key_points": [
    "Akrites initiative launched by Linux Foundation to handle AI bug reports",
    "AI lowers barrier for vulnerability hunting, creating surge of reports",
    "Akrites aims to validate findings and coordinate fixes with maintainers"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}