IBM and Red Hat Commit $5 Billion to Redefine the Future of Open Source in the AI Era
Project Lightwell establishes a trusted enterprise clearinghouse for open source software with a new AI-driven model for securing the software supply chain
This is a Press Release edited by StorageNewsletter.com on June 23, 2026 at 2:01 pmIBM and Red Hat announced Project Lightwell, a $5 billion commitment backed by new frontier AI capabilities and a global force of more than 20,000 engineers to help enterprises secure open source software. Together, these investments establish a new model for enterprise use of open source software, from upstream development through production environments.
Project Lightwell will establish a trusted enterprise clearinghouse combined with a global force of engineers to identify and fix vulnerabilities at scale. The clearinghouse will serve as a security coordination layer, using advanced AI capabilities to validate and test fixes across an unprecedented volume of open source code. These capabilities will be offered through commercial subscriptions, allowing enterprises to integrate secure patches directly into their existing software supply chains with enterprise-grade validation and lifecycle management.
Open source software underpins modern enterprise infrastructure, with more than 90% of Fortune 500 companies relying on OSS. At the same time, advances in frontier AI are accelerating vulnerability discovery and exploitation. Anthropic recently reported that its Mythos Preview model identified nearly 3,900 high- or critical-severity vulnerabilities in open source software alone.
IBM and Red Hat have already begun collaborating with a select group of early adopters on Project Lightwell, including Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa and Wells Fargo. The real-world insights from these initial deployments will actively shape how vulnerabilities are identified, validated, and remediated at scale across complex software supply chains.
Project Lightwell builds on IBM and Red Hat’s leadership in open source, enterprise AI and security, and incorporates learnings from initiatives such as Anthropic’s Project Glasswing and OpenAI’s Trust Access for Cyber, with a goal of utilizing new IBM agentic security methods to protect the foundational open source layers that underpin modern enterprise and AI systems.
“Open source is the backbone of today’s digital economy and the foundation of modern AI, and we are at an inflection point in how it is built, secured, and scaled,” said Arvind Krishna, chairman and CEO, IBM. “With Project Lightwell, IBM and Red Hat are helping define a new industry model, one that brings together AI, engineering expertise, and trusted collaboration, to secure open source software at its source and across the entire supply chain. This is about strengthening trust in the systems that power business, government, and society.”
Launching a Trusted Open Source Security Clearinghouse
Project Lightwell builds on IBM and Red Hat’s proven enterprise open source model, extending it beyond their traditional product footprint. IBM already uses more than 62,000 open source packages, with deep expertise in over 10,000. Across technologies like Linux, Java, Kubernetes, Kafka, Ansible, Terraform, Flink, Cassandra and more, the companies operate one of the industry’s broadest commercial open source ecosystems, historically providing lifecycle management, validation, and patching for components within their platforms. Now, IBM and Red Hat are applying the same engineering discipline to the broader application landscape, including independent libraries, language toolchains, AI frameworks, and data streaming platforms.
This approach directly addresses the operational vulnerabilities enterprises face when managing independent open source code on their own. Through the clearinghouse model, enterprise organizations can:
- Report and resolve vulnerabilities: Responsibly share sensitive security issues discovered in their active software versions within a trusted intermediary framework
- Deploy validated patches: Receive patches optimized for production environments, spanning both Red Hat offerings and independent community code
- Coordinate upstream disclosures: Share fixes upstream so that open source communities can include them in long-term maintenance
This model allows enterprises to engage IBM and Red Hat to resolve critical security issues while strengthening open source overall through responsible upstream disclosure.
AI-Powered Engineering at Global Scale
At a time when many technology companies are using AI to reduce technical headcount, IBM and Red Hat are taking a different approach, positioning technical engineering capacity as a premium strategic asset and a source of market differentiation.
IBM and Red Hat will deploy a team of more than 20,000 engineers, augmented by advanced AI capabilities. This global technical force will operate across upstream and enterprise environments, focusing on:
- Upstream maintenance alongside open source community leaders
- High-volume, AI-assisted vulnerability review, triage, and prioritization
- Secure patch development, dependency hardening, and release engineering
Project Lightwell supports government priorities to secure digital infrastructure, protect critical systems, and strengthen the overall resilience of open source software ecosystems. More information about Project Lightwell is available here.
Comments
A few weeks ago, IBM and Red Hat unveiled Project Lightwell, a $5 billion joint commitment pairing frontier AI capabilities with more than 20,000 dedicated engineers to identify, validate and remediate vulnerabilities in open source software (OSS) used in enterprise production environments. We took time to analyze this announcement and its potential impact as it represents a innovative initiative in the domain thanks to the open source powerhorse represented by Red Hat. It illustrates also an answer to the potential security threat AI could represent especially with agentic approach within enterprises of any size. AI serves as a key vehicle to identify security holes and more globally potential issues but also by itself, by its nature and its way to work.
The program will be commercialized through subscriptions delivering signed, validated patches integrated into customers' existing software supply chains, with enterprise-grade lifecycle management. It is already validated by early adopters, they are drawn almost entirely from regulated financial services: Bank of America, BNY, Citi, Goldman Sachs, JPMorganChase, Mastercard, Morgan Stanley, Royal Bank of Canada, State Street, Visa and Wells Fargo. IBM chairman and CEO Arvind Krishna framed it as an inflection point for how OSS is secured; Red Hat president and CEO Matt Hicks positioned it as scaling Red Hat's two-decade backporting practice across the entire application stack. The companies cite learnings from Anthropic's Project Glasswing and OpenAI's Trust Access for Cyber, leveraging IBM's emerging agentic security methods.
Project Lightwell extends Red Hat's proven enterprise-OSS model, historically scoped to RHEL, OpenShift, Ansible and similar platforms, to the broader application ecosystem, including independent libraries, language toolchains, AI frameworks, build tools and data streaming platforms such as Kafka. Acting as a trusted clearinghouse, IBM and Red Hat ingest sensitive vulnerabilities under embargo, backport validated signed patches to the exact pinned dependency versions already in production (no forced upgrades, no customer source code access required), then contribute fixes upstream for long-term community maintenance. Integration is minimal: customers point existing build tools like Artifactory, Nexus or Maven at a Red Hat secure registry via a one-line configuration change. Initial focus is Maven/Java, the priority for regulated industries needing pinned-version remediation, with planned expansion to PyPI, npm and Go. Project Lightwell is positioned as complementary to discovery-layer tools (Snyk, Sonatype, GitHub Advanced Security), delivering the SLA-backed remediation step they don't. Notably, IBM and Red Hat are framing engineering capacity as a premium strategic asset, using AI for ingestion and triage acceleration but retaining human judgment for backport compatibility and upstream disclosure, a deliberate counter to industry headcount reduction trends.
The market backdrop justifies the scale: more than 90% of Fortune 500 companies rely on OSS (Worldmetrics), CVE disclosures exceeded 40,000 in 2024 (cve.org) and IBM projects up to 59,000 by 2026. The acceleration is AI-driven: Anthropic's Mythos Preview model alone identified nearly 3,900 high- or critical-severity OSS vulnerabilities. IBM and Red Hat currently use over 61,700 OSS packages, with deep expertise in 10,600+, participating in 290+ major projects spanning Linux, Kubernetes, Java, Apache, Kafka, Ansible and Terraform. By industrializing patching and upstream contribution as a commercial subscription extending well beyond their own product footprint, IBM and Red Hat are monetizing maintenance burden that regulated enterprises have struggled to handle internally, and consolidating their position at the foundational layer of both enterprise and AI infrastructure stacks.
Subscribe to our free daily newsletter
