AI Tool Automates Open Source Patches Within Hours
Lightwell, built by Red Hat and IBM, targets exploit windows that have shrunk to about 18 hours, though it is announced rather than generally available.
Updated on Nov. 3, 2026 in Artificial Intelligence
Live Poll
Do you trust large tech companies to keep software secure from hackers?
Red Hat launched Lightwell, an AI-driven open source supply chain security clearing house, built with IBM, to automatically identify, patch, and distribute fixes for open source vulnerabilities. The initiative is presented as an announced platform; the extraction does not establish general availability or a shipping date.
Why it matters
Vulnerability disclosure-to-exploitation windows have collapsed from years to hours, which makes manual patching cycles of roughly 10 to 40 days a structural liability. Automated remediation tooling of this kind is a direction the industry is moving toward as AI agents take on more of the software supply chain.
The keynote cited mean Time-to-Exploit falling from about 2.3 years for a CVE in 2018 to 18 hours in 2026, while typical patch deployment still takes 10 to 40 days. An industry forecast projects as many as 66,000 CVE disclosures in a year, but the extraction does not report measured results for Lightwell itself.
The players
Red Hat
Open source enterprise software company whose OpenShift platform and Red Hat AI Enterprise anchor its AI and container stack.
IBM
Technology company that co-founded Lightwell with Red Hat and has a long history in enterprise software and security.
NVIDIA
GPU and AI infrastructure company whose NVIDIA AI Enterprise and OpenShell runtime pair with Red Hat's AI Factory offering.
Miho Miura
President of Red Hat Japan, who delivered the keynote opening Red Hat Summit Connect Tokyo 2026.
Takeshi Izaki
Vice President of Enterprise Business at NVIDIA Japan, who presented the Red Hat AI Factory with NVIDIA in Tokyo.
The details
Lightwell, a platform founded by Red Hat together with IBM, is embedded into Red Hat OpenShift continuous integration, the automated pipeline that builds and tests software on each change. An AI agent detects where a given open source patch must be applied and distributes continuous fixes across the software stack. The initiative was reported at a cost of 5 billion dollars.
Timeline
2018: mean Time-to-Exploit of a CVE was about 2.3 years.
2026: mean Time-to-Exploit of a CVE collapsed to 18 hours.
2026: Red Hat Summit Connect Tokyo opened with a keynote by Miho Miura.
The Tech Race
Lightwell sits alongside NVIDIA OpenShell, an open source, policy-governed runtime that sandboxes autonomous AI agents, as both companies build governance layers around agentic software. The competitive question is whether security automation becomes a standard feature of enterprise AI platforms or remains a separate product category.
Lightwell is presented as an announced platform, and the extraction gives no general availability date or pricing, so enterprises using Red Hat OpenShift should treat it as a development to watch rather than a deployable tool today. Teams running open source software in continuous integration pipelines are the most directly affected group if and when it becomes available.
The takeaway
The trajectory is clear: when exploitation windows shrink to hours, patching has to become automated and continuous rather than scheduled. Watch whether Red Hat publishes measured remediation times for Lightwell against the 18-hour exploitation benchmark cited at the Tokyo keynote.
Further reading
For broader context on how AI agents are reshaping software development, explore our Artificial Intelligence coverage.
Source note: This article includes information reported by Enterprise IT News.
Live Poll
Do you trust large tech companies to keep software secure from hackers?
