White House starts Gold Eagle vulnerability clearinghouse

The Trump administration on Tuesday launched Gold Eagle, a federal clearinghouse meant to coordinate AI-assisted discovery and repair of software vulnerabilities. The White House framed the effort as a way to reduce duplicated work among researchers and companies as frontier AI models produce more bug findings than maintainers and security teams can easily process.

The administration did not identify the companies taking part in Gold Eagle, including which AI developers are contributing model access or other resources. That omission matters because several private-sector efforts already exist in the same lane, and because the program depends on industry and independent researchers sending sensitive vulnerability information through a shared process.

Gold Eagle will use the Vulnerability Information and Coordination Environment, known as VINCE, as its operating hub. The platform is run by the federal government with Carnegie Mellon University’s Software Engineering Institute. According to the administration, anyone will be able to submit vulnerabilities into the program for review, coordination and mitigation.

National Cyber Director Sean Cairncross told reporters Tuesday that VINCE would support vulnerability and patch coordination at a speed and scale the government has not previously achieved. The White House said Gold Eagle has already started receiving and prioritizing security flaws from multiple industries and sectors, coordinating checks of reported issues and working toward software and network fixes.

Open source is the central pressure point

The program is aimed in large part at open-source software. That emphasis is unsurprising: open-source packages sit inside enterprise stacks and critical infrastructure, while many projects are maintained by small teams or volunteers with limited time for triage. The problem has become sharper as AI systems generate more reports, including some that are useful and others that still consume maintainer attention.

Cairncross described open-source developers as key partners for Gold Eagle and said their code is essential to U.S. life. The practical issue for those maintainers is less abstract. A flood of AI-generated findings can create a triage burden even when a portion of the reports are accurate, and a government clearinghouse only helps if it filters, verifies and coordinates fixes faster than existing channels.

President Donald Trump directed the creation of Gold Eagle in a June executive order on AI security. The White House called the program a new operating model for cyber defense, but the public details so far leave basic implementation questions open, including how vulnerabilities will be prioritized, how quickly fixes will move to end users and which companies will provide AI capabilities.

Gold Eagle enters a crowded field

The government effort is not arriving in a vacuum. The Linux Foundation, backed by Anthropic, Microsoft and other technology companies, has set up Akrites to help the open-source community identify and handle vulnerabilities. Chainguard has also launched Athena with Cisco, Cloudflare, JPMorgan Chase and other companies, focused on fixing open-source vulnerabilities before attackers find them.

Those private programs include frontier AI companies and participants connected to Anthropic’s Project Glasswing and OpenAI’s Daybreak coalitions. Anthropic has said it would take part in the government-led clearinghouse, but the Trump administration has not named the full roster of Gold Eagle participants.

A legal dependency could become a constraint. Gold Eagle’s vulnerability information-sharing model relies on liability protections under the Cybersecurity Information Sharing Act. Congress temporarily reauthorized that law in February through the end of September. The Trump administration has asked lawmakers for a 10-year reauthorization, arguing that the protections are needed for broad cybersecurity collaboration.

For enterprise security teams, the signal is straightforward: Washington wants a more centralized role in coordinating AI-assisted vulnerability discovery, especially for open-source software. Whether Gold Eagle reduces noise or adds another reporting channel will depend on execution details the administration has not yet made public.

This story draws on original reporting from CIO Dive.