Finding and Fixing Vulnerabilities Using AI

2.5 AI organizations, projects, and services

There is massive investment in AI, so it’s impossible to list all important organizations, projects, and services. That said, here are a few you should be aware of. Knowing about these will help you better understand the options available to you.

AI “frontier labs” drive foundational research by massively investing in designing and training the best AI models (called “frontier models”). There are many frontier and near-frontier labs. Key US players include Anthropic (Claude/Claude Code), OpenAI (GPT/ChatGPT), Google DeepMind (Gemini), and Meta AI (Llama). Microsoft partners with OpenAI, but it also conducts its own independent research and maintains strategic partnerships across the industry. Note that Microsoft Copilot isn’t a single product but a name for many different Microsoft tools that use AI. Key Chinese players include Moonshot AI (Kimi), Alibaba (Qwen), DeepSeek (DeepSeek), and Zhipu AI aka Z.ai (GLM).

Goose is a general-purpose AI agent that runs on your machine. It is open source software and maintained by the Linux Foundation’s Agentic AI Foundation (AAIF). When using Goose, you can select an “LLM provider” that can be local or remote, open source or closed source. For more information, see: <https://goose-docs.ai/>. Pi is another agent harness that supports many models. Pi focuses on being minimal and was created to develop code, though it can be used for other purposes <https://pi.dev/>.

The OWASP “GenAI Security Project” at <https://genai.owasp.org/> has a variety of materials available on AI and security. This includes its OWASP GenAI LLM Top 10, which identifies the “most critical security risks facing applications powered by large language models (LLMs)”.

The OpenSSF AI/ML Security Working Group has a variety of projects, including work on signing AI models. It is also a co-sponsor of this material. For more information, see <https://openssf.org/groups/ai-ml-security/>.