IBM and Red Hat launch Lightwell to defend open-source code from AI attacks

Their plan to protect open-source projects from AI-discovered security holes has led to the launch of two commercial offerings: Lightwell Network and Lightwell Clearinghouse Premier.

For software developers, AI is both a blessing and a curse. On the one hand, AI enables developers to build programs faster than ever. On the other hand, AI enables hackers to find and exploit security holes even faster.  To deal with this, IBM and Red Hat launched Project Lightwell.  Backed by a $5 billion, AI-powered initiative, Lightwell's job is to find and fix vulnerabilities in open-source software at an industrial scale. Now, it's moved from a project to products: Lightwell Network and Lightwell Clearinghouse Premier. Also: Open-source security is a mess – IBM and Red Hat bet $5 billion and 20,000 engineers can fix it Lightwell Network is generally available, while Lightwell Clearinghouse Premier is entering a limited-availability onboarding phase. According to the companies, "Lightwell now extends that proven enterprise protection to an organization's entire software portfolio." Both services provide a way to secure open-source components for enterprises, not just those that ship inside Red Hat and IBM products. Both companies emphasize that this is not so much a new approach as a supercharged open-source mega-project backed by AI and 20,000 engineers. It's "a model built on decades of trust, in which Red Hat has secured the most critical systems in the world for thousands of customers," and scaling it to cover a much broader slice of the software stack. At the heart of the offering is what the pair describes as "the high-throughput capability of a generative AI-powered remediation engine that is already live and operating at scale." This automation pipeline "combines frontier AI models with human engineering expertise to identify, validate, and remediate vulnerabilities across critical dependencies embedded deep within modern software architectures."  Also: IBM says it can fit nearly 100 billion transistors on a chip – why the milestone matters Rather than insisting customers constantly chase upstream releases, Lightwell "uses automation to backport critical fixes directly to exact, long-lived production software versions, helping to address the lengthy regression testing and breaking changes that often paralyze teams forced to adopt major upstream upgrades." The first new product, Lightwell Network, provides "immediate access to an active and growing library of content spanning latest to legacy libraries with high-value remediations." Members receive "a continuous stream of digitally signed binaries, source code, and comprehensive compliance artifacts, including complete Software Bills of Materials (SBOMs), delivered directly into existing pipelines without code drift." The second, Lightwell Clearinghouse Premier, is "designed to serve as a trusted intermediary for deep industry collaboration, advanced vertical threat coordination, and secured patch embargoes."