Chainguard Outlines Athena’s Vulnerability Discovery and Disclosure Plans
Summary
Chainguard says Athena has processed over 40,000 findings and produced more than 2,000 patches. It plans to disclose an initial 50 previously untracked fixes, pursue scoped CNA status, and use Mythos to test open-source software in isolated microVMs.
Key points
- Chainguard reports that Athena has collected more than 40,000 findings across 500+ projects; 42% are critical or high, and more than 2,000 patches have been produced.
- The initial disclosure batch is about 50 “silent fixes”: flaws already fixed in current code but lacking CVEs, with older versions still potentially affected. Chainguard says it will publish patches and advisories and provide patched versions to its customers.
- Chainguard is working to become a CNA for a limited scope of open-source vulnerabilities without an identifier or available maintainer, where no more specific CNA applies. It says findings must be reproduced and version ranges established, with maintainer notification and a process to withdraw incorrect assignments.
- Chainguard says one six-hour Mythos run found more than a dozen validated vulnerabilities in an unnamed, widely used open-source project, most of them pre-authentication RCEs. The company says each was reproduced three times in a clean VM.
- Athena’s untrusted code and AI-agent jobs run in microVMs with hypervisor-enforced egress limited to package registries; Chainguard says a forbidden connection destroys the VM and credentials are not placed inside it.
Article Details
- Event Type
- Security research and vulnerability disclosure program update
- Impact
- Chainguard reports that Athena has processed more than 40,000 findings across more than 500 projects, with 42% rated critical or high and more than 2,000 patches produced. The company plans to begin disclosing an initial batch of about 50 silent fixes on September 28 and is in progress to become a CVE Numbering Authority in partnership with CISA. Chainguard also reports that a six-hour Mythos run found more than a dozen validated vulnerabilities, mostly pre-authentication remote code execution, in an unnamed open-source project; the findings are being handled through Akrites. The article does not identify the project or report exploitation of these findings.
People
Vendors
AnthropicThe second reason I'm worried is less about process and more about what I've seen. We joined Anthropic's Project Glasswing. Lots of organizations have, at this point, roughly 200 across 15-plus countries, so our joiningChainguardWe publish the patch. Plain .patch files, in a public Chainguard repo that says exactly what it is on the tin, under the project's original license. This is deliberately not a maintainer-of-last-resort move. We haveHugging FaceDario built his essay around, OpenAI's agents breaking out of a cyber evaluation and ending up inside Hugging Face's production infrastructure, started with a zero-day in the package cache the agents had been given.OpenAIhas been a run of examples of people running it unsafely. The incident Dario built his essay around, OpenAI's agents breaking out of a cyber evaluation and ending up inside Hugging Face's production
Products
AntigravityPillar Security spent a week in July publishing sandbox escapes across Cursor, Codex, Gemini CLI, and Antigravity, and the finding that tied them together was that the agent almost never broke the sandbox head-on. ItAthenaAn update on Athena, and some unsolicited predictions on what's coming nextChainguard LibrariesWe ship the fix. Patched versions land in Chainguard Libraries for every Chainguard customer the moment the advisory goes live.Codexone landed close to home. Pillar Security spent a week in July publishing sandbox escapes across Cursor, Codex, Gemini CLI, and Antigravity, and the finding that tied them together was that the agent almost neverCursorso that one landed close to home. Pillar Security spent a week in July publishing sandbox escapes across Cursor, Codex, Gemini CLI, and Antigravity, and the finding that tied them together was that the agent almostGemini CLIclose to home. Pillar Security spent a week in July publishing sandbox escapes across Cursor, Codex, Gemini CLI, and Antigravity, and the finding that tied them together was that the agent almost never broke theMythoscountries, so our joining isn't news on its own. What matters is what it means for Athena: we now have Mythos, and we're running it against the software we build and ship.
Industries
Critical infrastructurecame out of June's executive order, is the layer that gets prioritized findings in front of the critical infrastructure operators who can't move on an attacker's timeline.Softwaremodel pointed at the power grid, the water system, the hospital network, all of it running on decades of software with the same exploitable design. The frontier is where the capability comes from. Consumption is where