IBM & Red Hat Launch Lightwell: Secure AI Open Source Supply Chains

IBM and Red Hat have launched Lightwell, a new service designed to secure open source software supply chains in the AI era. Lightwell offers automated vulnerability remediation through two main services: Lightwell Network and Lightwell Clearinghouse Premier. Lightwell Network is available now, providing access to over 6,500 remediated, digitally signed, and certified application dependencies for major ecosystems like Java and Python. Lightwell Clearinghouse Premier is in a limited-availability phase, acting as an intermediary for secure patch embargoes and threat coordination. This launch follows a $5 billion commitment to open source security announced in May 2026 by IBM and Red Hat. The service uses a generative AI-powered remediation engine, combining AI models with human expertise to identify and fix vulnerabilities. Lightwell aims to remove friction between innovation and compliance by securing software packages in production and establishing a platform for future applications. It uses automation to backport critical fixes directly to specific software versions, addressing lengthy testing and breaking changes. The goal is for Lightwell's catalog of remediated packages to scale rapidly from thousands to millions. This matters because it provides a new way to secure the open source software that many organizations rely on.