Chainguard discloses thousands of AI found vulnerabilities

Chainguard’s Athena project has begun disclosing a tranche of previously fixed-but-unfiled vulnerabilities, in a bid to accelerate defensive action as AI-assisted vulnerability discovery accelerates. The organisation says Athena has been ingesting findings since June, tallying more than 40,000 findings across over 500 projects, with 42% rated critical or high and more than 2,000 patches produced.

On 28 September, Chainguard started publishing, beginning with about 50 “silent fixes”—vulnerabilities already fixed at head, often in old versions where no CVE was filed. These fixes affect old deployed versions rather than the currently maintained branches, and the advisory and patch flow are being structured to reach teams still running those older releases.

Chainguard explains that upstreams often don’t merge fixes to old versions, so they are publishing three outputs for each item: a plain patch file in a Chainguard repo, a public advisory via an OSV feed with exact affected ranges and symbols, and patched versions delivered to Chainguard customers.

The broader effort places Chainguard as a CVE-numbering authority (CNA) for open-source vulnerabilities found via Athena when upstream fixes lack an identifier or no maintainer remains. This expansion, aligned with the Gold Eagle framework and Akrites pooling, aims to prioritise disclosures and upstreams where feasible.

The post also details a practical example from a run using Mythos (Athena’s open-source harness) against a widely used project, producing more than a dozen validated, largely pre-authentication RCE findings in about six hours, demonstrating how quickly AI-driven findings can translate into exploitable results if patches lag. The piece cautions that the patching race is outpaced by attacker capability, and calls for faster foundations to reduce the attack surface.