Akrites: The Latest Attempt to Protect Open-Source from AI Attacks Has Arrived

- Major open-source projects (including PyPI, npm, and Linux kernel) are increasingly targeted by attackers who use AI to generate malicious code that bypasses human review. This has led to supply-chain attacks — compromising widely used libraries to infect downstream users. - Akrites is a new security framework designed to detect AI-generated code contributions before they are merged into open-source repositories. It uses machine learning to flag commits that exhibit statistical patterns typical of AI output. - Previous defense attempts include Sigstore (for signing code), Trusted Publishers (for identity verification), and various static analysis tools — but none specifically focused on distinguishing human vs. AI authorship at scale. - The name Akrites refers to Byzantine border guards (akritai), reflecting the project's role as a defensive perimeter for open-source infrastructure. - The initiative comes amid growing unease: AI coding assistants (e.g., GitHub Copilot) can be used to propose plausible but subtly malicious code, and attackers can automate PR spam against maintainers who are already overwhelmed.