Chainguard Disrupts Vulnerability Disclosure with AI-Driven Flood of Findings

“More than 40,000 findings, 42% of them critical or high, across more than 500 projects, with more than 2,000 patches produced.”

Athena’s first disclosures: fifty quiet fixes, starting September 28

Athena has been ingesting findings since June; Chainguard says it will begin public disclosure on September 28 with an initial batch of about fifty items. Those first fifty are deliberate: low‑stakes, “silent fixes” already applied at head in upstream repositories where no CVE was ever filed. Chainguard will publish three artifacts for each such finding — a plain .patch in a public Chainguard repo under the project’s original license, an advisory via a Chainguard OSV feed with exact affected version ranges and symbol‑level detail, and patched versions shipped into Chainguard Libraries for Chainguard customers the moment the advisory goes live.

Chainguard’s CNA work and the disclosure gates

To convert silent fixes into machine‑actionable signals, Chainguard is in progress to become a CVE Numbering Authority (CNA), scoped to open source vulnerabilities processed through Athena where an upstream already fixed the flaw without an identifier, or where no maintainer remains to assign one. That work is explicitly done in partnership with CISA and in support of the Gold Eagle initiative. Chainguard says it will only assign where no upstream CNA will; every assignment must clear gates: a reproduced finding (never raw model output), a defensible commit range, evidence of affected versions in real use, maintainer notification with a response window, and withdrawal if the maintainer demonstrates the assignment is wrong.

Project Glasswing, Mythos, and a six‑hour run that matters

Chainguard joined Anthropic’s Project Glasswing and said it now runs Mythos against the software it builds and ships. One example run — described as the “least reassuring” result — targeted a single widely used open source project and returned, in about six hours, more than a dozen validated vulnerabilities, most pre‑authentication remote code execution, each reproduced three times in a clean VM before being recorded. Chainguard emphasizes that the project was not abandoned: it is heavily scanned and fuzzed, yet a model produced validated remote exploits in an afternoon. Chainguard routes these findings through Akrites, the shared disclosure body the Linux Foundation launched in June.

MicroVM sandboxes, the harness, and the rule: the host votes

Chainguard describes running every job in a hardware‑virtualized microVM: a clean kernel, root filesystem built from scratch, egress enforced at the hypervisor and allowlisted only to package registries, and a policy that the first forbidden connection destroys the VM. No credentials enter the guest. The development loop is explicit: agents search, but a finding only enters the record if the host can replay it against a clean instance — “the host casts the vote, never the model.” Chainguard summarizes operational lessons from its harness: every agent starts with fresh, bounded context; every write is gated on evidence and a host‑runnable replay; research steers but does not prove; dead ends are recorded as findings; and “taste beats fleet size” when choosing where agents look next.

What this means for open‑source maintainers, CISA and critical infrastructure operators, and enterprise security teams

• Open‑source maintainers: projects that fixed a bug at head but never filed a CVE should expect new advisories for older, still‑deployed releases; Chainguard says it will not pre‑notify every upstream but offers a contact at cna@chainguard.dev for maintainers who want coordination.
• CISA and critical infrastructure operators: Chainguard frames Gold Eagle — the federal clearinghouse created after the June executive order — as the path to prioritize findings for operators who “can't move on an attacker’s timeline.” Chainguard is working with Gold Eagle to route prioritized discoveries there.
• Enterprise security teams: Chainguard warns that the “median enterprise is months behind on patches” and that faster disclosure will increase scanner noise — intentionally — because the alternative is silent, exploitable risk. Chainguard plans narrow advisories with module‑, class‑, and function‑level detail to help reachability scanners cut false positives.

Chainguard’s sober forecast is twofold. Shorter term, faster discovery and disclosure will flood existing pipelines already described as full: “the flood is coming, and the pipes were already full.” Longer term, Chainguard frames the only true “endgame” as new foundations — stacks built secure by construction so that dominant vulnerability classes (memory corruption, deserialization, injection, confused deputies) cannot be written in the first place. Chainguard says it is working on such foundations and will describe progress when there is more to say.

Read the original post: https://thehackernews.com/2026/11/the-flood-is-coming-and-pipes-were.html