project
Linux Foundation and OpenSSF coalition launched at the end of June 2026 to coordinate AI-enabled vulnerability reports to upstream open-source maintainers, operating a shared SIRT and a standardized coordinated disclosure process.
No evidence-backed relationships are recorded.
Microsoft's FORGE lab helped discover Windows flaws assigned 140 CVEs from May to September 2026, 52 of them fixed in the September release. Microsoft says the pace now depends on how fast its response center can validate and fix what the AI agents report.
Reality
Chainguard disclosed 14 Java vulnerabilities that were fixed upstream but never assigned a CVE, one rated critical and one high. Teams still on the affected versions got no scanner alert, some for years, because nobody announced the fixes when they landed at HEAD.
Reality
Chainguard says its Athena coalition will start releasing about 50 findings on September 28, with affected version ranges attached. A scanner needs those ranges before it can flag a pinned old release.
Reality
Chainguard says fix generation was never its bottleneck and that responsible disclosure at scale is, so its first public batch is built from bugs upstreams quietly fixed years ago and never filed CVEs for.
Reality
The Linux Foundation's coalition for AI-generated vulnerability reports starts taking automated submissions next month. Its membership terms set the ceiling on what it can absorb.
Reality