Chainguard’s new Athena coalition uses AI to fix open-source flaws – before attackers exploit them


Chainguard Athena

Chainguard / ZDNET

Follow ZDNET: Add us as a preferred source on Google.


ZDNET’s key takeaways

  • Chainguard and friends will use AI to protect open-source code from attackers.
  • Athena uses the resources of open-source users, developers, and maintainers.
  • Chainguard isn’t the only one seeking to secure open-source code with AI.

As everyone in IT knows, or should know anyway, AI has opened up a new front in attacking open-source code security. Hacking used to require real skill. Now, anyone with a sufficiently advanced AI model can pry open programs and infect them with AI-custom-made malware. The software company Chainguard, which specializes in zero-CVE container images and security-hardened open-source code, is joining with others to beat the attackers to the punch with Athena.

As Chainguard puts it, “The gap between a vulnerability being discovered and being exploited has collapsed from years to hours, and a growing share of exploits are weaponized before the bug is ever publicly disclosed. Coordinated disclosure was built for a world in which finding a serious flaw took weeks, and the targets were few. That world is gone.” Chainguard is right. It is.

Also: Treat your AI agents like eager but misguided human interns – before you lose control

Something had to be done. As the company’s CEO and co-founder, Dan Lorenc, wrote on LinkedIn, we had a “choice between letting open-source security fragment into a dozen rival patch sets nobody can reconcile, or doing the hard, coordinated thing instead. I said it would only work if we built it together, and admitted I had no idea if we actually would. Here’s the update: the industry showed up. It’s called Athena, and it’s live.”

Anthony Grieco, Cisco’s SVP, chief security and trust officer, agrees. “For decades, Cisco has helped secure the open-source ecosystem. That work now faces new urgency; frontier AI has accelerated the vulnerability discovery cycle beyond what traditional coordinated disclosure was built to handle. Chainguard’s Athena Coalition represents an important evolution, the coordination of open-source vulnerability intelligence and defense at the pace these threats demand.”

Chainguard bets on AI as a defensive shield

Athena comes with two parts. The first is a coalition of more than two dozen companies that will collaborate to hunt down and remediate flaws in widely used open-source software using cutting-edge AI models. Its supporters are a who’s who of finance and enterprise infrastructure companies such as JPMorgan Chase, Cisco, Cloudflare, Docker, Kyndryl, and PwC.

Also: 5 security tactics your business can’t get wrong in the age of AI – and why they’re critical

These companies already face stringent regulatory and customer pressure around software supply-chain risk. The coalition gives them a way to pool data, AI capabilities, and remediation work on vulnerabilities that cut across their stacks. The aim is to shift from one-off, project-specific fixes to a coordinated model in which critical AI-identified open-source software flaws can be found and addressed before they appear in attacker playbooks.

Fixing flaws before attackers can find them

Technically, Athena’s core promise is speed. It will find and patch open-source vulnerabilities “before attackers can find them.” Under the program, AI systems will sift through massive volumes of open-source code and dependency graphs to flag potential weaknesses so they can be validated and fixed upstream.

Also: 5 ways to fortify your network against the new speed of AI attacks

Sometimes, however, the patches aren’t available as quickly as we’d want or need. To address this, Chainguard explains: “Athena stacks independent layers of protection so that coverage exists even where a clean patch does not yet, and stays on every flaw until a durable upstream fix is in place.”

This approach looks like this:

  • Discovery — Vetted findings are pooled from across the coalition, including frontier research programs such as Anthropic’s Project Glasswing and OpenAI’s Daybreak. Athena accepts findings generated by all frontier models.
  • Pre-embargo remediation — Private forks and rebuilt, hardened versions are made available to members through Chainguard Libraries before disclosure: Findings are addressed in batches across an entire library, hardening it against whole classes of issues rather than a single bug. If a model happens to surface a flaw first, it stays quiet even when a more capable model arrives.
  • Continuous reconciliation — Every finding is reconciled against upstream activity throughout the embargo, catching independent discovery and keeping fixes current as projects move ahead.
  • Platform, network, and infrastructure mitigations — Partners that operate infrastructure, platform, network, and security layers push non-patch mitigations ahead of disclosure: detection signatures, traffic-level rules, and platform-side blocks that neutralize a flaw without the affected software ever being touched, at machine speed and broad reach.
  • Detections and vendor mitigations — Cybersecurity partners add their own detections, signatures, and virtual patching as a further independent layer.
  • Upstream disclosure and hard forks — The coalition drives coordinated upstream disclosure, and Chainguard hopes to work with the Linux Foundation on a coordinated Security Incident Response Team for open source and a maintainer-of-last-resort program.

Also: Linus Torvalds on the AI claim that makes him angry, and what security researchers should never do

Chainguard is tying the initiative directly to its secure-by-default product line, which includes SLSA Level 3-compliant builds, signed artifacts with Software Bill of Materials, minimal images, and packages rebuilt from source daily to keep vulnerability counts near zero. By feeding Athena’s findings into this factory, the company says it can rapidly ship hardened containers, libraries, virtual machines (VMs), and open-source packages that incorporate fixes. Simultaneously, this gives customers a clear provenance trail for compliance regimes ranging from FedRAMP and HIPAA to the EU’s Cyber Resilience Act and NIS2.

A new front in the open-source AI security race

Chainguard and its friends aren’t the only ones trying to get everyone on the same page when it comes to securing open-source code. IBM and Red Hat are throwing billions of dollars and thousands of engineers at the problem.

The Open Source Security Foundation (OpenSSF) is also working on OSS-CRS as a new open-source project within the AI/ML Security Working Group. This is a standard orchestration framework for building and running LLM-based autonomous bug-finding and bug-fixing systems.

Also: Open-source security is a mess – IBM and Red Hat bet $5 billion and 20,000 engineers can fix it

For CISOs and regulators watching the AI security story unfold, Athena will be a test case of whether AI-augmented collaboration on open-source vulnerabilities can scale beyond marketing slogans into measurable reductions in exploitable bugs. Personally, I think Chainguard and company can pull it off.

After all, as Lorenc pointed out, “Athena is operational today. More than 20,000 findings processed, 2,000 patches across 500 projects, first coordinated disclosures in about a month.”

However, as Lorenc said, “Will it be perfect? No, and no one should pretend otherwise. But fragmentation is worse, standing still isn’t survivable, and the more of the industry that’s in, the less any attacker has left to find. Join us.” You should. If anything’s going to save our code, it will be efforts like Athena.





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews







2026 has shaped up to be a big year for Milwaukee, and the company shows no signs of slowing down as it expands its product line. For example, it has announced that some solid new Milwaukee hand tools and organizers will be arriving throughout the summer, but that’s not all. At the end of the day, you need somewhere to put all of this stuff, and while the Milwaukee Packout storage system is deep and varied as is, the company will expand the line in the summer months.

More methods for organizing your tools are on the way, too, with the Milwaukee Packout line set to introduce some new entries this summer. They vary in size, purpose, and price point, but they’re all compatible with the wider Packout line. That means they can connect to each other, making transportation easier. In some cases, they’ll be able to help keep tools and other items secure and organized while on the move. Additionally, all of these new Packout products are covered by Milwaukee’s Limited Lifetime Warranty.

So, what new products does Milwaukee have to offer from its Packout line this summer? Here are the drops you can look forward to throughout June and July 2026.

Milwaukee compact crate

Sometimes, a massive Packout crate isn’t a necessity, which is why the line has its share of smaller options. Yet another will be coming to the Milwaukee catalog in the form of the Milwaukee Packout compact crate, which is set for a June 2026 release and will cost $39.97. It has a 30-pound weight capacity, comes in at 8.75 inches tall, 9.5 inches wide, 15.5 inches long, and 3.75 pounds, and includes two removable dividers to create up to three sections within the crate. The dividers can also be customized by cutting them to size along the pre-made score lines.

This compact crate features a wide front opening for easy access to its contents while on the job, as well as a metal top handle to carry it around on its own. Should you want to add it to your current Packout stack, you can use the connection points at the top and bottom of the crate. Speaking of durability, Milwaukee notes that it has an impact-resistant body along with weep holes to prevent water collection. At the same time, there is some nuance regarding the waterproof nature of Milwaukee Packout products, so keep that in mind before letting this crate get soaked.

Milwaukee Packout low-profile crate

A shorter but equally mighty Milwaukee Packout container is also on its way to customers this summer. The Milwaukee Packout low-profile crate is the shortest of the new releases at just 6.625 inches tall, though it makes up for what it lacks in height with a 15-inch length and an 18.625-inch width. Even though it’s slightly heavier than the compact crate at 4.85 pounds, it wins out in weight capacity with a 50-pound limit. It will be released in June 2026 and will cost $44.97.

For added modularity, the low-profile crate includes three different divider types: eight short, two long, and one for the middle of the container. When combined, they form up to 12 individual sections for tool and accessory organization. In terms of connecting to other Packout containers, it can do so from the top and bottom. Alternatively, built-in side handles are integrated into the design to make it easier to carry the crate on its own. The crate has weep holes for water drainage and an impact-resistant body.

Milwaukee Packout XL crate

Moving on to one of the larger upcoming Milwaukee Packout releases — even if it ultimately lands somewhere in the middle of the smallest and largest Packout containers for sale — there’s the aptly-named Milwaukee Packout XL crate. This release will hit shelves in June 2026 and comes with a $69.97 price tag. The 8.03-pound crate can take on some serious tools with its 75-pound weight capacity. It measures 15 inches tall, 15.75 inches long, and 18.625 inches wide. Despite its size, it can be hung up on a wall like most other Packout containers.

While some may hang this crate in their workshop, many will use it as part of their mobile Packout stack. You can connect it to your existing setup via the top and bottom connection points. It can also be used with Milwaukee toolbox attachments to hold smaller tools and batteries with connection points on the sides. Alternatively, you can move the crate around using its built-in side handles. It’s advertised as having an impact-resistant body along with anti-water collection weep holes. Suffice to say, there’s more to this seemingly simple crate than initially meets the eye.

Milwaukee Packout Wire Pulling XL Crate

For the most part, the Milwaukee Packout line is so popular because of its versatility. While most entries can be used for just about anything, there are those that come with a specialized function. Case in point, the forthcoming Milwaukee Packout Wire Pulling XL crate, which is designed for dispensing wire. This involves inserting and locking in spools of the user’s needed material, threading the wire through the wire retention slots, and using the fold-down panel to keep the end of the wire from rolling back into the box.

Overall, this crate has the same dimensions and weight capacity as the previously covered Packout XL crate, though it is the heavier of the two at 9.85 pounds. It can accommodate up to six spools, can be stacked onto other Packout containers or hung up, and has an impact-resistant body. This is the most expensive of the new Packout releases at a hefty $119.97, and it’s set to release during July 2026. Alongside the best Milwaukee power tools for electrical work, this crate seems like a vital piece for any Milwaukee-enthusiast electrician’s kit.

New Milwaukee Packout inserts are coming, too

That’s it for the new Milwaukee Packout containers set to debut this summer, but there are more new releases yet to cover. To pair with some of these containers and improve their levels of organization and function, come two new insert sets. First is the divider for the Milwaukee Packout XL crate, which splits the container into two sections. It simply slides down the middle of the crate and fits snugly into place, while retaining its ability to connect with smaller Packout attachments. It will be released in July 2026 for $29.97.

Alongside the Packout XL crate divider is the set of Packout wire pulling inserts for the XL crate. You’ll need these if you end up buying an XL crate and later want to use it as a wire-pulling crate. These inserts allow you to convert it instead of having to buy a new designated wire pulling crate. They attach to two of the inner sides of the crate via T-25 screws and include wire puller guards as well. The Milwaukee product listing says these inserts are meant for 1/2-inch EMT conduit. This insert set also comes out in July and will cost $49.97. 





Source link