Software has a serious and growing security problem, and AI is both causing it and being used to fix it. The same AI tools that help developers write code faster are also helping security researchers, and attackers, find flaws in that code at a speed that no human process was built to handle.
The numbers are stark. A major industry study found that the average number of known security flaws per commercial software product more than doubled in one year, reaching 581 flaws per product on average. Around 87% of audited products contained at least one known vulnerability. The software most at risk is open-source software: code that is freely shared and used as a building block in most commercial software, often maintained by unpaid volunteers who have no budget, no team, and no capacity to process hundreds of AI-generated bug reports per week.
The US government's Gold Eagle program is a direct response to this. It operates as a clearinghouse: a single place where anyone can report a flaw, where the government will verify and prioritize it, and where fixes get coordinated and pushed out to affected users. The technical platform sits at Carnegie Mellon University's Software Engineering Institute. The program was mandated by a presidential executive order signed in June 2026.
The real story here is not the government program. It is that industry already acted first.
The Linux Foundation launched a program called Akrites on June 25, backed by Amazon, Anthropic, Google, Microsoft, OpenAI, Cisco, JPMorgan Chase, and a dozen others. Akrites sets up a single response team for coordinating fixes before flaws are made public, so attackers cannot exploit them during the gap between discovery and patching. Chainguard's Athena coalition, which includes Cisco, Cloudflare, JPMorgan Chase, and PwC, is doing similar work. In just three weeks of operation, Athena processed over 40,000 vulnerability reports. Of those, 42% were classified as critical or high-severity, and 86% were reachable over a network, meaning an attacker could trigger them remotely.
Gold Eagle and these industry programs are not in conflict. Anthropic has confirmed it will participate in Gold Eagle, and the private programs have stated they will coordinate with government efforts. But the sequencing matters. Private industry, seeing the same crisis, assembled large coalitions and started processing real flaws weeks before the government program launched. The government is now entering a space that already has significant momentum and infrastructure.
There is one real risk sitting under all of this. Gold Eagle depends on a law called the Cybersecurity Information Sharing Act, which gives companies legal protection when they share threat information with the government. Without it, companies risk lawsuits or regulatory exposure if they share data that later turns out to touch on someone's private information. That law is currently extended only through September 30, 2026. If Congress does not renew it, the legal foundation for the entire information-sharing model collapses, and companies may stop sharing. The Trump administration has called for a 10-year extension, but the law has already lapsed once and required emergency short-term patches.
For any operator running software, this matters in a practical way. The hidden software your business depends on, the components inside your accounting system, your logistics platform, your customer database, is built on open-source building blocks. The security of those building blocks is now being examined by AI at a scale and speed that has never existed before. Flaws that sat undiscovered for decades are now being surfaced in days. The gap between a flaw being found and a criminal using it is now measured in hours, not months. Whether the fix reaches your system in time depends on how well these coordination programs work.