Since Anthropic announced Project Glasswing, more than 23,000 vulnerabilities have been identified across over 1,000 open source projects in the first month alone. More than 6,000 were assessed as high or critical severity, and over 90% were validated as true positives by independent security researchers. Glasswing's partners found more than 10,000 additional high- and critical-severity vulnerabilities across the critical software systems they operate.
Yet, fewer than 5% have been fixed so far. The implications are profound.
Today, we're moving to close that gap by launching Endor Zero-Day Patches: verified, tested fixes for novel open source vulnerabilities delivered in under 24 hours, before there's an upstream patch or even a CVE.
And we're not going it alone. As a founding member of Project Akrites, the Linux Foundation's new initiative for coordinated remediation and disclosure of vulnerabilities in critical open source projects, Endor Labs is joining Anthropic, OpenAI, Amazon, Chainguard, Cisco, Citi, IBM, JPMorgan Chase, Microsoft, and others to solve the problem. Every fix we write flows back to the community through a shared, trusted channel.
Why the gap won't close on its own
Around 90% of the software that powers our banks, hospitals, governments, and critical infrastructure depends on open source maintained by a diverse community of companies, foundations, small teams, and volunteers.
These maintainers are responding, and many are doing extraordinary work. Some are patching faster than they ever have. This is not a story about maintainers failing. The problem is structural: no volunteer ecosystem was designed to absorb tens of thousands of new, validated vulnerability reports every month. Anthropic itself has reported that maintainers are asking it to slow down disclosures because they cannot keep up.
In June 2026, the curl project, whose code runs on 20-30 billion devices, announced it would stop accepting vulnerability reports entirely for the month of July, closing its HackerOne intake and letting its security inbox go dark. Maintainer Daniel Stenberg wrote that after four months of relentless pressure from AI-generated vulnerability reports, the team simply needed rest, and that they did not expect the deluge to be over.
Right now, each new frontier model widens the gap between how fast vulnerabilities are found and how fast they get fixed. Anthropic expects Mythos-class capabilities from multiple AI companies within 6 to 12 months, potentially without the safeguards applied today. The same capabilities defenders are using this morning will be available to attackers soon after, pointed at the same millions of open source projects, hunting the same decades-old flaws, with targets that include banks, critical infrastructure, and governments.
Introducing zero-day patches for open-source vulnerabilities
In response to urgent requests from major enterprises, we are expanding Endor Patches to address the rapid growth in novel open source based zero-days uncovered through Anthropic’s Project Glasswing or OpenAI’s Daybreak. Until now, Endor Patches backported fixes that maintainers had already written, to the older versions you actually run.
A zero-day has no upstream fix yet. So Endor Zero-Day Patches does the harder thing: it leverages AURI, our agentic application security platform, to build the call graph, analyze dataflow, create the patch, and verify that it passes tests before it gets deployed into a customer environment.
Our customers are already running Mythos- and Daybreak-class models against their own software estates, and those models are surfacing serious flaws in the open source packages their applications depend on. Today, a customer who finds a new critical vulnerability has nowhere to take it except back to the source. With Endor Zero-Day Patches, customers disclose those findings to us, in line with their own disclosure obligations, and we’ll provide them a verified and tested fix in 24 hours.
With AI, the pace of vulnerability discovery exceeds the pace at which issues can be fixed, making it critical that we invest in tools that quickly identify threats and safeguard our development process. Endor Labs creates rapid and verified fixes for zero-day vulnerabilities, helping close critical exposures as soon as they are found.”
– Arvind Purushotham, Head of Citi Ventures
That fix lives in your environment only until the upstream release catches up. We are not building a parallel distribution for you to adopt permanently, and we are not becoming the maintainer of the projects you depend on.
Maintainers stay in control with a patch, not a fork
We’re also a founding member of Project Akrites, the Linux Foundation’s initiative for coordinating the validation, remediation, and disclosure of vulnerabilities in critical open source projects. Instead of sending a maintainer yet another security advisory, we route our work through Akrites’ coordinated disclosure process, so a maintainer hears about an issue once, with the context already attached: a validated vulnerability, a fix written and tested against their code, and the build and test logs behind it.
For maintainers, fixes do not sit behind a paywall. As vulnerabilities are responsibly disclosed and maintainers are ready for them, the patches flow upstream for free, benefiting the entire open-source ecosystem.
Most importantly, we are not trying to take stewardship of these projects, or become a separate place you go to get a safer version of them. The fix goes upstream, the maintainers stay in control, and once the fix lands, our customers move off our local patch and back onto the release—no hard fork required.
One rule is absolute. We fix and disclose. Every finding that enters our pipeline also enters the coordinated disclosure pipeline, and we never hold back disclosure or a fix once it is reported to us.
Why we believe we can do this
We’ve always believed that finding vulnerabilities is the easy part, and that fixing was the problem to solve. That’s what we’ve spent the last four years building and it's why we can author a fix in hours instead of triaging a report for weeks.
This starts with prioritization. When AI hands your organization 10,000 validated findings, the first question is where to start. A vulnerability can be completely real in a library and still be unreachable from your application, because your code never calls the affected function. Our function-level reachability analysis answers that question, for your specific applications, across your direct and transitive dependencies. That turns an undifferentiated wall of criticals into a ranked list of what threatens you first.
Rubrik uses frontier models to find vulnerabilities at machine speed, and Endor Labs to help prioritize, categorize and coordinate the remediation of exploitable vulnerabilities. That's one of the ways we stay resilient and move fast at the same time.”
– Michael Mestrovich, CISO, Rubrik
Then the fix itself. Our proprietary static analysis engine, built over four years across millions of packages, extracts the code context and the data flows around each flaw. That lets us find deterministic paths to a fix with the smallest possible change to the original code, instead of a sprawling rewrite that maintainers won't accept and enterprises won't trust.
Next is verification. In addition to the patch, we also generate tests and exploits that cover the vulnerability, and provide build and test logs as evidence of the appropriate fix.
The fixes flow back to the community, and for free.
Our commitments
1. Fixes should benefit the entire ecosystem.
Organizations may partner with us to accelerate remediation for software they depend on. But our goal is not a world where only paying customers become secure. As vulnerabilities are responsibly disclosed and maintainers are ready to receive them, our fixes flow back to the open source community, free. The software supply chain is shared infrastructure. Making it safer benefits everyone, and we will publish our upstreaming numbers so anyone can check..
2. Collaboration matters more than ownership.
No company can solve this problem alone. We welcome collaboration with open source maintainers, software vendors, security researchers, governments, critical infrastructure operators, and frontier AI labs. The challenge ahead is larger than any individual organization. We do not need perfect consensus, we just need progress.
3. Speed is a requirement.
The gap between discovery and remediation is growing every month. Bureaucracy cannot become the bottleneck. We will move quickly, iterate with customers, learn from the community, and continuously improve. We do not claim to have every answer. We do believe the time to start is now.
Join us
If you're an enterprise staring down this backlog, join the early access waitlist. We're selecting design partners now, starting with organizations whose critical software carries the most exposure.
If you're a maintainer, researcher, foundation, or frontier lab that wants to collaborate, we want to hear from you. Reach us directly here. Maintainers of affected projects never need a waitlist to receive a fix.
The age of machine-speed vulnerability discovery has arrived. Now it's time to build machine-speed remediation.
What's next?
When you're ready to take the next step in securing your software supply chain, here are 3 ways Endor Labs can help:
